TEMP.Armageddon
TEMP.Armageddon, also referred to as CARPATHIAN and identified in the content as UNC530, is a Russian-nexus cyber espionage threat actor operating out of occupied Crimea and Eastern Ukraine. The group is described as Kremlin-linked and has been observed targeting Ukrainian entities, including military, government, and technology sectors, for espionage purposes. Reported tradecraft includes use of removable media for propagation, specifically USB-driven malware such as QUICKGAME to gain and extend access in victim environments. The actor has also been observed exploiting the WinRAR path traversal vulnerability CVE-2025-8088 using crafted RAR archives to place HTA downloader files into Windows Startup folders for persistence and execution at user login. In this activity, the HTA acts as a downloader for second-stage payloads. The content states this TEMP.Armageddon/CARPATHIAN activity continued into 2026.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Exploits CVE-2025-8088 via RAR archives to plant HTA downloaders in Windows Startup for persistence and second-stage payload delivery; activity observed through Jan 2026.
Kremlin-linked activity exploiting CVE-2025-8088 to target Ukrainian military/government/technology sectors.
Russian-nexus espionage activity exploiting/attempting to exploit CVE-2025-8088 against Ukrainian targets.
Exploiting CVE-2025-8088 to drop HTA downloaders into Windows Startup folders for persistence and subsequent payload retrieval; activity ongoing into 2026.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.