razing_ursa
Razing Ursa is a Russian threat actor referred to in the provided content as Sandworm and Voodoo Bear, and also associated with GRU Unit 74455. The content links the actor to destructive operations and malware, including attribution by the UK FCDO for the 2018 Pyeongchang Winter Olympics Olympic Destroyer wiper incident. That operation disabled Wi-Fi at the opening ceremony as well as the Olympics website, ticketing, and broadcast drones, with more than 300 systems reportedly compromised and restoration taking 12 hours. The content also links Razing Ursa to the destructive Linux wiper families AcidRain and AcidPour. AcidRain is described as targeting MIPS-based modems and routers, while AcidPour targets x86-based storage arrays and industrial control systems. In the cloud-focused reporting provided, AcidRain and AcidPour are identified as destructive Linux wipers associated with this actor.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Media & Entertainment
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇰🇷 South Korea
- 🇯🇵 Japan
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian state-linked actor attributed with destructive Olympic-related operations including Olympic Destroyer and later reconnaissance/disruption activity around Tokyo 2020/21.
Razing Ursa is a Russian threat actor known for deploying destructive wiper malware (AcidRain, AcidPour) against infrastructure, including modems, routers, storage arrays, and industrial control systems.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.