🇷🇺 RU2 malware families

o1oo1

Also known aso1oo1

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Where they're from

Attributed origin per open-source reporting.

MITRE ATT&CK

Tradecraft

16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

9 of 15 tactics35 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

1 technique

T1566

Phishing

TA0002

Execution

3 techniques

T1053

Scheduled Task/Job

T1053.005

Scheduled Task

T1059

Command and Scripting Interpreter

T1204

User Execution

T1204.002

Malicious File

TA0003

Persistence

3 techniques

T1053

Scheduled Task/Job

T1053.005

Scheduled Task

T1546

Event Triggered Execution

T1546.015

Component Object Model Hijacking

T1547

Boot or Logon Autostart Execution

T1547.001

Registry Run Keys / Startup Folder

TA0004

Privilege Escalation

5 techniques

T1053

Scheduled Task/Job

T1053.005

Scheduled Task

T1055

Process Injection

T1055.001

Dynamic-link Library Injection

T1546

Event Triggered Execution

T1546.015

Component Object Model Hijacking

T1547

Boot or Logon Autostart Execution

T1547.001

Registry Run Keys / Startup Folder

T1548

Abuse Elevation Control Mechanism

T1548.002

Bypass User Account Control

TA0005

Stealth

1 technique

T1055

Process Injection

T1055.001

Dynamic-link Library Injection

TA0006

Credential Access

3 techniques

T1056

Input Capture

T1056.001

Keylogging

T1539

Steal Web Session Cookie

T1555

Credentials from Password Stores

T1555.003

Credentials from Web Browsers

TA0008

Lateral Movement

1 technique

T1021

Remote Services

T1021.005

VNC

TA0009

Collection

2 techniques

T1056

Input Capture

T1056.001

Keylogging

T1115

Clipboard Data

TA0011

Command and Control

1 technique

T1105

Ingress Tool Transfer

ARSENAL

Associated malware families

2 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

AsmCryptBy 2023, however, o1oo1 had made the jump from buyer to a malware developer, launching a private crypter service... The service is known publicly as AsmCrypt.1Jun 12, 2026

SilabRATIn this blog, we deep-dive into SilabRAT and look at some of its interesting capabilities.1Jun 12, 2026

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

group ibNews

Jun 10, 2026

SilabRAT, What’s Your Power? | Group-IB Blog

Russian-speaking malware developer and vendor behind SilabRAT and the AsmCrypt crypter service, selling SilabRAT as a MaaS offering and enabling financially motivated campaigns involving credential theft, session hijacking, HVNC, and cryptocurrency-focused theft.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping16

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal2

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.