Russian intelligence
Russian intelligence (as referenced in the source content) is described as conducting espionage and cyber operations against Western targets, including Sweden and the United States, and being linked in reporting to broader hybrid/sabotage activity in Europe. In Sweden, authorities detained a former IT consultant to Sweden’s Armed Forces on suspicion of spying for Russian intelligence, with suspected activity assessed to have occurred throughout 2025 into early 2026 and possibly since 2022. The case is treated as a national security matter by the Swedish government. The reporting also states Sweden has been targeted by Russian cyber espionage and hybrid operations amid Sweden’s support for Ukraine. In the United States, “Russian hackers” are reported to have breached the federal judiciary’s court filing ecosystem (case management/electronic filing and PACER), compromising sealed records and sensitive documents; the judiciary implemented measures to restrict transmission of sealed documents to public platforms. The content characterizes the threat as persistent and sophisticated, with prior foreign-actor breaches noted (including in 2022). The content also cites Russian intelligence in the context of the SolarWinds supply-chain compromise as an example motivating regulation of managed service providers, and situates alleged Russian intelligence/sabotage activity within a broader European crackdown and concerns about sabotage (e.g., suspected links to Baltic Sea submarine cable damage). No specific sub-groups or aliases are provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Suspected of conducting espionage activities targeting Sweden, including cyber espionage and hybrid operations such as sabotage of submarine cables in the Baltic Sea.
Russian intelligence is known for conducting sophisticated cyber-espionage campaigns, including the high-profile SolarWinds supply chain attack, which targeted a wide range of organizations globally, including government and critical infrastructure.
Conducting cyberattacks against the U.S. federal judiciary's case management and electronic filing systems, compromising sealed records and sensitive information.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.