GRU
GRU is Russia’s military intelligence service, referred to in the content as the Main Intelligence Directorate / Main Directorate of the General Staff of the Armed Forces and Russian military intelligence. The content attributes multiple cyber and related operations to the GRU, including interference in the 2016 U.S. presidential election; hacking of the Democratic National Committee (DNC), Democratic Congressional Campaign Committee (DCCC), and Clinton campaign officials; theft of voter data from a U.S. state election board; use of spearphishing, credential theft, malware including X-Agent, keystroke logging, screenshots, data exfiltration, leased U.S.-based infrastructure, and staged leaks via the DCLeaks and Guccifer 2.0 personas and WikiLeaks. The content specifically identifies GRU Units 26165 and 74455, both in Moscow, as carrying out most of that campaign, with Unit 74455 also described as the Main Center for Special Technology. The content also attributes February 2022 DDoS attacks against Ukrainian banking, defense, and government entities to the GRU, with U.S. and UK officials citing technical links to known GRU infrastructure. Additional activity mentioned includes targeting Yulia Skripal’s email accounts in 2013, alleged involvement in cyber operations supporting Russia’s war against Ukraine, and use of the Moobot botnet of compromised Ubiquiti Edge OS routers to proxy malicious traffic in cyberespionage attacks targeting the United States and its allies. Known aliases in the content are GRU, Main Intelligence Directorate, Main Directorate of the General Staff, and Russian military intelligence.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
45 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
The NotPetya attacks began by targeting Ukrainian agencies, but it quickly spread through the use of the EternalBlue exploit, which was developed by the National Security Agency and used in the WannaCry ransomware attacks.
In its own advisory for the CVE-2023-50224 vulnerability, TP-Link said that many of its products are affected, but that all of them have reached end-of-life status, which means they are no longer supported by the company.
Observables
19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Used the Moobot botnet of compromised Ubiquiti Edge OS routers to proxy malicious traffic for cyberespionage operations.
Attributed with hacking DNC emails during the 2016 U.S. election interference operation and transferring the stolen materials to WikiLeaks.
Russian military intelligence-linked activity described as targeting Western logistics entities, technology companies, and the defense industry, using credential access (guessing/brute force) followed by post-compromise tradecraft leveraging shell, Active Directory, and PowerShell commands, and conducting exfiltration and influence operations.
Referenced in the context of a CISA advisory describing Russian GRU activity targeting Western logistics entities and technology companies, with post-compromise activity involving shell/Active Directory/PowerShell commands, credential access, and influence operations; targets include the defense industry.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.