russian_state_sponsored_threat_actors
Russia-nexus state-sponsored threat actors are described as expanding operations in Europe and conducting cyber operations driven by the war in Ukraine. Their targeting in Europe includes government, defense, and infrastructure networks, with activity characterized by intelligence collection and efforts to undermine Western support to Ukraine. Tactics explicitly mentioned include phishing for intelligence collection. Separately, Russia (along with China, Iran, and North Korea) is reported to have sharply increased the use of AI for online deception and cyberattacks against the United States, including generating fake online content, translating phishing emails, and creating digital clones of senior government officials. The broader objectives attributed to government cyber operations in this context include obtaining classified information, undermining supply chains, disrupting public services, and spreading disinformation. No specific Russian actor aliases or sub-groups are named in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian state-sponsored threat actors are conducting hybrid operations including cyber-espionage, sabotage, influence operations, and physical attacks targeting NATO member states, especially around the 2025 NATO Summit. Their activities include deploying new malware, recruiting operatives for sabotage, targeting critical infrastructure (including submarine cables), and using AI-generated media for disinformation.
Russian state-sponsored actors used ChatGPT to generate code for malware operations and to automate social engineering campaigns.
Russian state-sponsored threat actors are conducting destructive cyberattacks and web defacements against Ukrainian government entities, likely as part of coordinated 'Active Measures' in the context of heightened military tensions. There is concern that further attacks, such as NotPetya-style wipers or Industroyer ICS attacks, could coincide with or follow military conflict.
Russian state-sponsored actors are leveraging AI to conduct cyberattacks, spread disinformation, and engage in espionage against the US and its allies. They are also known to collaborate with cybercriminal gangs for profit-driven attacks.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.