Loading story…
Russian authorities said foreign hackers acting as cyber mercenaries breached multiple federal executive bodies and stole confidential information in a targeted campaign uncovered in 2020. A joint report from Rostelecom-Solar and the National Coordination Center for Computer Incidents said the intruders used three primary access routes: tailored spear-phishing, exploitation of internet-facing web application flaws, and compromises of government contractors that enabled trusted-relationship access into agency networks.
After gaining entry, the attackers conducted internal reconnaissance, targeted administrators’ workstations and infrastructure management systems, and collected data from mail servers, document management platforms, file servers, and employee endpoints. Investigators said the operation relied on previously unseen malware, including Mail-O and Webdav-O, to provide stealthy backdoor access, execute commands, and exfiltrate data through Russian cloud services while mimicking legitimate Yandex Disk and Mail.ru Disk-O traffic. The report also said the attackers tailored their activity to evade detection by deployed security tools, including abuse of legitimate components of a widely used Russian antivirus product to gather information about victim networks.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Russian authorities publicly disclosed a joint Rostelecom-Solar and NKTsKI report describing the campaign's tactics, including spear-phishing, web application exploitation, and contractor compromise. The report also revealed two previously unseen malware strains, Mail-O and Webdav-O, used as stealthy backdoors and for data exfiltration via Russian cloud services while mimicking legitimate Yandex.Disk and Disk-O traffic.
Solar JSOC specialists at Rostelecom-Solar, together with Russia's National Coordination Center for Computer Incidents, identified a series of targeted intrusions affecting Russian federal executive authorities. The attacks involved theft of confidential information and were later assessed as the work of cyber mercenaries acting in the interests of a foreign state.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcert-solar.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK National Cyber Security Centre, FBI, NSA, and CISA warned that Russia’s Foreign Intelligence Service (**SVR**), also tracked as **APT29** and **Nobelium**, is running a broad cyber-espionage campaign that combines mass exploitation of known vulnerabilities with targeted intrusions against governments, diplomats, think tanks, technology firms, financial institutions, and cloud environments. Officials said the group scans the internet for unpatched systems and exploits long-known perimeter flaws including `CVE-2019-19781`, `CVE-2019-11510`, `CVE-2018-13379`, and `CVE-2020-5902`, then uses compromised accounts to move deeper into victim networks and, in some cases, into connected supply chains. The campaign builds on tradecraft previously tied to the **SolarWinds Orion** compromise and later phishing and cloud-focused operations attributed to the SVR. U.S. and allied advisories said the service has shifted toward stealthier methods such as password spraying, abuse of mailbox and cloud permissions, temporary email infrastructure, and reduced reliance on custom malware, though earlier operations also used tools such as **SUNBURST**, **TEARDROP**, **Cobalt Strike Beacon**, and **WELLMESS**. Microsoft separately reported that Nobelium targeted thousands of accounts across hundreds of organizations in a focused espionage effort, while defenders were urged to prioritize patching internet-facing systems, enforce multi-factor authentication, audit identity and mailbox permissions, and investigate signs of lateral movement and account abuse.
Aug 15, 2026
Russian-speaking threat group **OldGremlin** carried out a series of ransomware and spearphishing attacks against organizations in Russia, an unusual targeting pattern for a financially motivated group operating in the region. Group-IB linked at least seven phishing campaigns since spring 2020 to the actor, with lures tied to **COVID-19**, media outreach, and the Belarus protests, while impersonating entities including **RBC**, **SRO MiR**, **Novadent**, **Minsk Tractor Works**, and a metallurgical company. Reported victims included a large medical company as well as banks and industrial firms. In one documented intrusion, attackers used a phishing email masquerading as RBC to gain initial access, then deployed custom malware including **TinyNode** and **TinyPosh**, followed by **Cobalt Strike** for post-exploitation. The group established persistence through registry run keys, executed PowerShell and JScript, stole credentials, moved laterally over **RDP** and **SMB**, wiped backups, and finally encrypted the network with **TinyCryptor** ransomware. Group-IB said the operation also used Tor-based command-and-control infrastructure, APC-based process injection, and **RC4**-encrypted communications, aligning the activity with multiple **MITRE ATT&CK** techniques.
Aug 14, 2026
A previously unreported cyber espionage campaign has been uncovered targeting Russian military personnel and defense industry organizations. The campaign, attributed to the group known as Goffee, utilized phishing lures such as fake New Year concert invitations and forged official letters to entice victims into opening malicious XLL files. Once executed, these files deployed a new backdoor named EchoGather, which enabled attackers to collect system information, execute commands, and exfiltrate files to a command-and-control server disguised as a food delivery website. The phishing documents showed signs of artificial generation, including linguistic errors and poorly imitated Russian emblems, suggesting the use of AI-generated decoys to enhance stealth and evade detection. Researchers from Intezer first identified the malicious XLL file on VirusTotal, with uploads originating from both Ukraine and Russia. The campaign demonstrates the evolving tactics of the Goffee group, which has been active since at least 2022, as they experiment with new methods to bypass security controls. The use of AI-generated content and XLL-based payloads highlights a growing trend in cyber espionage operations, particularly those targeting sensitive sectors such as defense. The full extent of the campaign's success and the specific data sought by the attackers remain unclear, but the operation underscores the persistent threat posed by sophisticated, state-aligned cyber actors.
Jun 29, 2026