Reading · Cyber News Network

This assessment characterises the ten highest-consequence Russian state-sponsored, state-directed and state-tolerated cyber threat actors as of August 2026, and evaluates their relevance to Western critical infrastructure and industrial enterprises. It is written for practitioners: each actor dossier carries attribution reasoning, tradecraft mapped to MITRE ATT&CK, malware and exploit inventories, victimology, and concrete detection guidance rather than narrative summary.

The assessment covers the three principal intelligence services with offensive cyber mandates — the GRU (military intelligence), the FSB (federal security service) and the SVR (foreign intelligence service) — together with the hacktivist fronts, splinter personas and tolerated criminal enterprises that constitute the periphery of the Russian offensive ecosystem. Influence-operations infrastructure is addressed only where it materially intersects network intrusion activity.

This product applies ICD 203 analytic tradecraft standards throughout. Three disciplines are enforced without exception:

■ Observed versus inferred. Every substantive statement is marked as either OBSERVED (documented by a named primary or tier-one source) or ASSESSED (an analytic judgement drawn from evidence). Where the two are combined in a paragraph, the boundary is made explicit.

■ Calibrated probabilistic language. Estimative statements use the ICD 203 lexicon reproduced below. Terms are used with their defined probability bands and are not interchangeable with confidence levels.

■ Separated confidence. Confidence (HIGH / MODERATE / LOW) reflects the quality, quantity and corroboration of the underlying evidence and the strength of the analytic logic. It is stated separately from likelihood, and the reasoning for the rating is given.

ICD 203 Probability Lexicon Used in This Report

All cited material is graded on the NATO Admiralty System at the point of use and consolidated in the Source Register at Annex D. Reliability is graded A (completely reliable) through F (cannot be judged); credibility is graded 1 (confirmed by other sources) through 6 (cannot be judged). In practice this report treats government advisories, indictments and sanctions designations as A1–A2, tier-one vendor threat research as A2–B2, and aggregator or single-source reporting as B3–C3.

Sourcing Discipline

Where a claim appearing in prior reporting could not be corroborated against a primary or tier-one source during this review, it is retained but explicitly marked UNCONFIRMED rather than repeated as fact. Where reporting was found to be incorrect, a correction is issued in the Verification Log at Section 3. Nothing in this document is asserted on the strength of a single unattributed aggregator claim.

Consistent with Intel Desk style, no inline citations appear in the body text. Every source relied upon is listed in the consolidated Source Register at Annex D with its Admiralty grade, publication date, and the specific judgement it supports. Readers auditing a claim should work from the register.

This report deliberately prioritises durable detection surface — tradecraft, tooling artefacts, protocol abuse and behavioural signatures — over atomic indicators. Published IP addresses, domains, hashes and TLS fingerprints associated with all actors described here should be assumed stale within weeks of publication. Where atomic indicators are referenced, they are provided as retrospective hunting pivots, not as blocklist content.

The following judgements are the analytic core of this assessment. Each is stated with likelihood and confidence, and is supported in the body of the report.

KJ-1

HIGH CONFIDENCE

Russia operates a federated, rivalrous offensive cyber apparatus rather than a unified command.

The GRU, FSB and SVR each maintain independent cyber portfolios with overlapping mandates, competing collection priorities and separate proxy ecosystems. This structure is OBSERVED in indictment records, unit designations and divergent tradecraft signatures. It is ASSESSED that this rivalry produces operational redundancy and tolerance for risk — the GRU in particular accepts exposure costs the SVR would not — and that defenders should therefore model three distinct threat profiles rather than one national doctrine.

KJ-2

HIGH CONFIDENCE

The highest-consequence threat to Western industrial and energy infrastructure remains Sandworm (GRU Unit 74455), and the December 2025 Poland grid attack demonstrates a repeatable operational template rather than an isolated event.

OBSERVED: a coordinated destructive campaign against Polish wind and solar generation, a combined heat and power plant, and a manufacturer, involving wiper deployment and damage to remote terminal units, protection relays and human-machine interfaces. ASSESSED with HIGH confidence that the pattern — long IT-side dwell, then a coordinated pivot to operational technology at a symbolically chosen moment — will recur. Attribution of the Poland event itself is genuinely contested between Sandworm and an FSB Centre 16-adjacent cluster and is reported as such.

KJ-3

HIGH CONFIDENCE

For an enterprise with an Azure and Microsoft 365-centric estate, the dominant Russian threat is identity and cloud abuse conducted by APT29 and Void Blizzard, not malware delivery.

OBSERVED across the Microsoft corporate breach, the CaptiveCrunch captive-portal campaign, and Void Blizzard operations: password spray, OAuth application and consent abuse, service principal credential addition, stolen session cookie replay, Microsoft Graph and Exchange Online bulk collection, and delegated-administration abuse. ASSESSED that conventional endpoint detection provides negligible coverage against this tradecraft and that identity telemetry is the decisive control surface.

KJ-4

HIGH CONFIDENCE

The December 2025 United States indictment materially strengthens the evidentiary basis for GRU direction of hacktivist fronts, moving it from vendor assessment to a charged allegation.

OBSERVED: the indictment states that CyberArmyofRussia_Reborn was founded, funded and directed by the GRU, and treats Z-Pentest as an alias of the same entity. ASSESSED with MODERATE confidence that the CARR / Z-Pentest relationship is better characterised as rebranding and persona migration than as the clean independent split described in earlier open-source reporting. This remains an open analytic question and is flagged as an intelligence gap.

KJ-5

MODERATE CONFIDENCE

Large language model integration into Russian offensive tooling has moved past experimentation and is likely to reach routine operational use during 2027.

OBSERVED: LAMEHUG, attributed by CERT-UA to APT28 with moderate confidence, queries a hosted code-generation model at runtime to produce reconnaissance and exfiltration commands; separately, a PowerShell wiper recovered from the Poland intrusion was assessed by responders as largely model-generated and consequently unsuitable for authorship attribution. ASSESSED that the primary near-term defensive consequence is attribution degradation and reduced static-signature yield, not a step change in destructive capability.

KJ-6

MODERATE CONFIDENCE

Law enforcement disruption imposes real friction on the Russian cyber periphery but does not degrade in-country operational tempo.

OBSERVED: Operation Eastwood removed more than one hundred servers from a DDoS network that continued operating within the same week; Operation Red Circus produced an extradition and charges; sanctions designations named leadership of multiple groups. ASSESSED that the principal value of these actions is attribution clarity, coalition signalling, and constraint on travel and finance — not capability denial. Defenders should not treat a takedown announcement as a reduction in exposure.

KJ-7

ROUGHLY EVEN CHANCE / MODERATE CONFIDENCE

A ceasefire or negotiated settlement in Ukraine would redirect rather than reduce Russian offensive cyber activity against NATO members.

ASSESSED that GRU and FSB capacity currently committed to Ukrainian targets would be reallocated toward pre-positioning in Western energy, logistics, water and manufacturing networks, and toward intelligence collection on alliance decision-making. The judgement is rated at roughly even chance because the alternative — a genuine tempo reduction as part of sanctions relief bargaining — remains plausible and has historical precedent in other domains. Confidence is MODERATE because the outcome depends on political variables not observable through technical collection.

KJ-8

HIGH CONFIDENCE

The most cost-effective single control available to an industrial enterprise against the Russian hacktivist tier is elimination of internet-exposed remote-access services to operational technology.

OBSERVED: joint advisory reporting documents pro-Russia hacktivists reaching human-machine interfaces in water, wastewater, energy and food and agriculture environments through internet-facing VNC services and default or weak credentials. ASSESSED with HIGH confidence that this tier possesses no capability to overcome even basic remote-access hygiene, and that closing this exposure removes the entire CARR, Z-Pentest and Sector16 threat surface at negligible cost.

This section documents the outcome of a source-verification pass against the working field guide that preceded this assessment. It is published in full because correction transparency is a tradecraft obligation, not an embarrassment. The overwhelming majority of prior reporting was corroborated; the exceptions below are material and are reflected throughout the body of this document.

Correction 1 — Actor Misattribution

LAUNDRY BEAR is not an APT29 subcluster. Prior reporting placed the Zimbra Collaboration Suite campaign and the associated custom capability under APT29 / SVR. This is incorrect. LAUNDRY BEAR is the designation applied by the Dutch AIVD and MIVD to a distinct Russia-affiliated espionage actor that Microsoft tracks as Void Blizzard. The Zimbra activity and the associated joint advisory belong to that actor. The two intrusion sets should not be conflated: their initial-access tradecraft, victimology and collection methodology differ materially. Void Blizzard is given a full dossier in this report at Section 7.11.

Correction 2 — Reporting Provenance

The STOCKSTAY backdoor was documented by Google Threat Intelligence Group in June 2026, not by Microsoft in July 2026. The distinction matters for source grading and for tracking which vendor holds primary visibility on the Turla intrusion set. Separately, the Microsoft reporting on Turla in 2025 concerned internet-service-provider-level adversary-in-the-middle activity and the ApolloShadow certificate implant — a distinct campaign from STOCKSTAY, and one that should not be folded into it.

Correction 3 — Contested Attribution Presented as Settled

The December 2025 Poland grid attack should be reported as contested attribution. ESET attributes the campaign to Sandworm at medium confidence on the basis of overlap with 2025 wiper incidents in Ukraine. CERT Polska’s incident reporting identifies infrastructure overlap with a separate cluster associated with FSB Centre 16 critical-infrastructure operations, and explicitly declines a high-confidence Sandworm call. Both positions are credible. Presenting either as settled would misrepresent the evidentiary state.

Correction 4 — Figure Conflation

The approximately ninety million dollar recovery cost figure belongs to the Kyivstar telecommunications attack of December 2023, not to the Poland grid attack. No verified financial impact figure for the Poland event was identified during this review. The Poland attack notably did not produce a blackout: endpoint detection deployed inside the operational technology environment intercepted the wiper. That outcome is the single most instructive detail of the entire incident and is treated as such in the recommendations.

Correction 5 — Analytic Tension on the CARR / Z-Pentest Relationship

Prior reporting described Z-Pentest as an independent, Serbia-based splinter formed in September 2024 by CARR administrators dissatisfied with GRU funding. The December 2025 indictment instead treats Z-Pentest as an alias of CARR and asserts continuing GRU direction. These positions cannot both be fully correct. This report presents both, assesses that persona migration and rebranding is the more likely reconciliation, and records the residual uncertainty as a formal intelligence gap at Annex C.

The following elements of prior reporting were checked against primary or tier-one sources and are confirmed. They are listed so that readers can distinguish verified content from content carried forward on trust.

The following were carried in prior reporting but could not be corroborated to primary-source standard during this review. They are not asserted as fact anywhere in this document.

■ Subordination of NoName057(16) to a specific Kremlin-affiliated youth-monitoring body. The association appears in credible vendor reporting but has not been asserted by any government in an advisory, indictment or designation. Treated as reported, not established.

■ The named campaign labels applied to some 2026 APT28 and Turla activity. The underlying operations are confirmed; several of the campaign names in circulation are vendor-internal or community coinages that do not appear in primary reporting.

■ Specific operational tempo figures for Sandworm before and after the Poland attack. Reported by a single vendor and not independently corroborated. Directionally plausible; the precise intervals are not relied upon.

■ The full membership roster of the claimed hacktivist alliance of approximately twenty groups. Single-source and self-declared by the participants. Alliance claims in this ecosystem are routinely inflated for propaganda effect.

■ One named Android surveillance family attributed to Gamaredon. Two of the three families cited in prior reporting are corroborated; the third could not be located in tier-one reporting and one appears to be a misrendering of a corroborated family name.

Western reporting frequently treats “Russian cyber” as a single actor. It is not. The three services with offensive mandates operate with different risk tolerances, different collection priorities and different relationships to the criminal underground. Modelling them as one adversary produces defensive programmes calibrated to an average that matches none of them.

OBSERVED: Russia does not extradite cybercriminals to Western jurisdictions, and prosecutes domestic cybercrime almost exclusively where Russian entities are victimised. Ransomware operators, initial access brokers and bulletproof hosting providers operate from Russian territory with effective immunity provided they observe two conditions — avoid Russian and allied targets, and remain available when tasked.

ASSESSED with HIGH confidence that this arrangement is deliberate policy rather than enforcement incapacity. The evidentiary basis is strong: leaked internal communications from a major ransomware syndicate revealed contact with the security services; a National Crime Agency report on a sanctioned syndicate stated that a former senior FSB official acted as a key enabler of the group’s relationship with Russian intelligence and that the group had been tasked to conduct attacks and espionage operations against alliance members; and multiple designated individuals have been documented moving between criminal and state-aligned operations without consequence.

Why This Matters Operationally

The practical consequence for defenders is that the analytic wall between “criminal ransomware incident” and “state intelligence operation” cannot be assumed to hold. ASSESSED with MODERATE confidence that any intrusion by a Russian-speaking ransomware affiliate against a defence-adjacent, energy, or government-supplier organisation should be triaged with the working hypothesis that collection may have occurred alongside — or instead of — extortion. Incident response scoping that stops at encryption impact will miss this.

The hacktivist and proxy ecosystem resolves into three tiers with materially different implications for attribution and for defence.

TIER 1

State-created and state-directed fronts

Personas established by an intelligence service to provide deniability for operations the service conducts itself. These are not hacktivists in any meaningful sense. Claims made by these personas should be read as attributable to the sponsoring unit. Examples: CyberArmyofRussia_Reborn, Solntsepyok, XakNet, Infoccentr.

TIER 2

State-aligned volunteers with tolerated status

Genuinely self-organised groups whose targeting aligns with state objectives and which operate with official indifference or informal encouragement. Direction is opportunistic rather than continuous. Capability is generally low but volume is high. Examples: NoName057(16) at the crowdsourced level, Z-Pentest in its post-split form.

TIER 3

Independent opportunists and rebrands

Low-capability groups riding geopolitical events for attention, frequently rebranding, routinely inflating claims. Analytic value lies mainly in what their targeting reveals about narrative priorities. Examples: the residual KillNet brand and its fragments, and the long tail of Telegram-native DDoS personas.

ASSESSED with MODERATE confidence that the ecosystem is consolidating rather than fragmenting. Three indicators support this: the migration of hacktivist personas from pure denial-of-service toward operational technology intrusion, which requires either capability transfer or direct assistance; the documented handoff of tooling between two separate FSB-attributed intrusion sets; and the increasing appearance of the same exploit — most clearly the WinRAR archive extraction flaw — in the hands of state units, state-aligned fronts and financially motivated actors within months of one another. ASSESSED that this reflects a shared supply chain for exploits and tooling rather than independent discovery.

PART TWO

Actor Dossiers

APT44 · Seashell Blizzard · Voodoo Bear · ELECTRUM — GRU Unit 74455

Sponsor

GRU Main Centre for Special Technologies (GTsST), military unit 74455

Mandate

Destructive and disruptive operations; operational technology effects; hack-and-leak via fronts

Active Since

At least 2009; ICS-capable since 2015

MITRE ID

G0034

Attribution Confidence

HIGH — United States indictment of six officers; multiple allied government attributions

Primary Targeting

Ukraine (energy, telecommunications, logistics, grain); NATO energy and manufacturing

Distinguishing Trait

The only actor globally with a repeated record of causing physical effects through cyber means

OBSERVED: Sandworm is attributed to the GRU’s Main Centre for Special Technologies, military unit 74455, by United States indictment naming six officers, and by corroborating attributions from allied governments. MITRE tracks the set as G0034. The attribution is among the best-evidenced in the discipline and is rated HIGH confidence.

The set is not monolithic. Reporting resolves it into functional sub-clusters: an initial-access development function that maintains persistent global footholds on internet-facing infrastructure and hands access to effects operators; the effects function itself, which conducts wiper and industrial control system operations; and a set of front personas used to claim operations publicly. Dragos tracks the access-development activity and the effects activity as two separate operational-technology threat groups, which is analytically useful — a defender may be inside the access group’s inventory for years without ever seeing the effects group.

ASSESSED with HIGH confidence that this structure is deliberate and that it materially lengthens the window between initial compromise and impact. The practical implication is that detecting Sandworm at the effects stage is failure; the detectable phase is the long, quiet access-maintenance period that precedes it.

OBSERVED: a coordinated destructive campaign executed on 29 December 2025 against the Polish energy sector. National incident reporting and vendor analysis document impacts across more than thirty wind and solar generation sites, a combined heat and power plant serving a customer base approaching half a million, and an industrial manufacturer. A wiper was deployed; damage extended to remote terminal units, protection relays, human-machine interfaces and serial device servers. Technical analysis of the remote terminal unit damage identified firmware corruption consistent with exploitation of a known vulnerability in a widely deployed substation automation product, producing a persistent boot loop that required physical intervention to remediate.

OBSERVED: no loss of supply occurred. Endpoint detection and response tooling deployed inside the operational technology environment intercepted the wiper before it completed. OBSERVED: the intruder at the combined heat and power plant had maintained access for approximately nine months prior to the destructive action.

Attribution Status — Contested

One vendor attributes this campaign to Sandworm at medium confidence, citing overlap with wiper incidents observed in Ukraine earlier in 2025. The national computer emergency response team identifies infrastructure overlap with a separate cluster associated with FSB Centre 16 critical-infrastructure operations and declines a high-confidence attribution to Sandworm. ASSESSED with MODERATE confidence that the operation was GRU-directed, on the basis of tooling lineage and target selection; ASSESSED with LOW confidence on the specific unit. Reporting this as settled Sandworm attribution would misrepresent the evidence.

OBSERVED: a major cloud provider’s threat intelligence function reported in December 2025, at high confidence, that Sandworm had shifted emphasis from exploitation of enterprise software products toward compromise of misconfigured customer edge devices — routers, virtual private network concentrators and remote-access gateways — for credential harvesting and replay against Western critical infrastructure. This continues a documented multi-year access-development programme previously observed exploiting network security appliances, collaboration platforms and backup software.

ASSESSED with HIGH confidence that edge and remote-access infrastructure is now the primary Sandworm initial-access surface, displacing spearphishing for this actor. This is the single most important targeting shift in this dossier for defenders.

OBSERVED: through 2025, regular deployment of multiple wiper families against Ukrainian government, energy, logistics and grain-sector organisations. Vendor reporting covering the April to September 2025 period documents at least three distinct wiper families in operational use. ASSESSED that the objective is economic attrition rather than tactical military effect, and that the grain-sector targeting in particular is intended to degrade export revenue.

OBSERVED sectors: electricity generation and transmission, telecommunications, logistics and rail, water, grain and agricultural processing, and — in the Poland event — discrete manufacturing. Geographic concentration remains Ukraine, with demonstrated willingness to conduct destructive operations inside NATO territory.

ASSESSED relevance to a United States industrial manufacturer with an Azure-centric estate, operational technology exposure and international offices: HIGH but indirect. Two findings from the Poland event drive this. First, a manufacturer was struck alongside primary energy targets, indicating that industrial organisations adjacent to an energy target are considered in scope. Second, the intruder dwelled on the information technology side for approximately nine months before pivoting to operational technology. ASSESSED that the exposure for such an enterprise is concentrated at the edge and at the information technology to operational technology boundary, not at the endpoint.

The detection strategy against this actor is asymmetric: the impact phase is trivially detectable and operationally useless to detect, while the access-maintenance phase is subtle and is where defensive value is concentrated. Prioritise accordingly.

Priority Hunt Hypotheses

■ Edge device configuration drift. Hunt unexplained configuration changes, new local accounts, and new administrative sessions on VPN concentrators, firewalls and remote-access gateways, particularly from residential, hosting-provider or anonymisation autonomous systems.

■ Credential replay following edge compromise. Correlate successful authentications using service or appliance accounts against source networks not previously associated with that account.

■ Group policy weaponisation. Alert on any modification to a group policy object that creates a scheduled task, startup script or immediate task targeting a broad computer scope. This is the highest-fidelity pre-impact signal available and should be a paging alert, not a dashboard tile.

■ Pre-impact defensive degradation. Event log clearing, shadow copy deletion, backup catalogue destruction and security agent tamper events occurring within a short window across multiple hosts.

■ Operational technology boundary anomalies. New protocol conversations crossing the boundary, engineering workstation authentications outside change windows, and unsigned firmware or flash utility execution on any host with a path to field devices.

Control Recommendations Specific to This Actor

1. Deploy endpoint detection into the operational technology demilitarised zone and onto engineering workstations. This is not a theoretical recommendation. It is the specific control that prevented a blackout in Poland.

2. Treat edge device firmware and configuration as a monitored asset class. Baseline configurations, alert on drift, and include appliance management planes in privileged access management.

3. Maintain offline, tested, physically separated recovery capability for control system configuration and firmware. Remote terminal unit firmware corruption is not recoverable from a network backup if the network is the vector.

4. Emulate the tradecraft. Run destructive-operation emulation covering group policy distribution, recovery inhibition and log destruction, and measure detection coverage. A coverage figure below eighty percent on these techniques should trigger funded remediation.

ASSESSED with HIGH confidence that Sandworm retains both the capability and the political authorisation to conduct destructive operations against NATO critical infrastructure, and that the Poland event constitutes proof of intent as well as capability. ASSESSED as VERY LIKELY that comparable operations against European energy infrastructure recur during the remainder of 2026 and into 2027, with symbolic or anniversary timing. The limiting factor on operations against United States soil is ASSESSED to be escalation calculus rather than capability or access.

Fancy Bear · Forest Blizzard · IRON TWILIGHT — GRU Unit 26165

THREAT LEVEL: CRITICAL

Sponsor

GRU 85th Main Special Service Centre, military unit 26165

Mandate

Strategic espionage; hack-and-leak; military and logistics intelligence

Active Since

At least 2004

MITRE ID

G0007

Attribution Confidence

HIGH — United States indictment of seven officers; French national attribution 2025

Primary Targeting

Government, defence, logistics and transportation supporting Ukraine; technology suppliers

Distinguishing Trait

Operational breadth — from password spray to Wi-Fi proximity attacks to model-assisted tooling

OBSERVED: attributed to GRU unit 26165 by United States indictment naming seven officers, and publicly attributed by the French national cybersecurity agency in April 2025 following compromise of a dozen French entities. MITRE tracks the set as G0007. Attribution confidence is HIGH.

ASSESSED that APT28 is the most operationally versatile Russian intrusion set. Within an eighteen-month window the same designation covers commodity password spray at scale, physical-proximity wireless attacks requiring on-the-ground preparation, zero-day exploitation of a mainstream productivity suite, and the first publicly documented deployment of runtime language-model integration in malware. This breadth is itself an analytic signature.

OBSERVED: a joint advisory published in May 2025 by twenty-one agencies across eleven nations documented a two-year campaign against Western logistics and technology entities involved in the coordination and delivery of assistance to Ukraine. Targeting spanned air, maritime and rail sectors across the United States, Germany, Poland, Romania, Czechia, France, Italy and Moldova.

OBSERVED tradecraft in that campaign: reconstituted password spray against internet-facing authentication; spearphishing; exploitation of internet-protocol cameras at logistics facilities and border crossings using streaming protocol requests and credential brute force, with the advisory noting that more than eighty percent of targeted cameras were located in Ukraine and that Romania and Poland carried the next highest concentrations; and modification of mailbox folder permissions to establish durable collection without retaining malware on the host.

ASSESSED with HIGH confidence that the camera targeting was intended to provide near-real-time observation of materiel movement — a collection requirement with direct tactical value. The advisory instructed defenders in the named sectors to adopt a posture of presumed targeting rather than risk-based prioritisation.

OBSERVED: exploitation of a Microsoft Office security feature bypass affecting object linking and embedding, patched out of band in late January 2026 and added to the Known Exploited Vulnerabilities catalogue with a February federal remediation deadline. Vendor reporting documents APT28 use of the flaw in a multi-stage campaign with cloud-hosted command and control against maritime and transport organisations across Poland, Slovenia, Turkey, Greece, the United Arab Emirates and Ukraine. Rich text format documents were the in-the-wild delivery vector.

OBSERVED: national computer emergency response team reporting of July 2025 documented a Python implant, attributed to APT28 at moderate confidence, that queries a hosted code-generation model through a public inference application programming interface to produce reconnaissance and exfiltration commands at execution time rather than embedding them. Subsequent vendor analysis identified a large number of authentication tokens used against that inference service. Exfiltration used both file transfer and web post methods.

ASSESSED with MODERATE confidence that the operational purpose was to reduce static detection surface and complicate attribution rather than to add capability. The commands generated were unremarkable; the delivery mechanism was the innovation. ASSESSED as LIKELY that this pattern proliferates.

OBSERVED: a documented attack in which the actor compromised an organisation in an adjacent building, located a system with both wired network access and a wireless adapter, and used it to authenticate to the true target’s enterprise wireless network from across the street — defeating controls predicated on physical proximity being infeasible for a remote adversary. OBSERVED separately: sustained use of compromised small office and home office routers for command and control, subject to at least one court-authorised law enforcement disruption operation. OBSERVED: a credential and token stealer operating within a mainstream mail client, publicly documented by a national cybersecurity authority.

ASSESSED relevance to a United States industrial manufacturer: HIGH where the organisation supplies, ships through, or provides technology services to entities involved in assistance to Ukraine or to NATO defence logistics. The joint advisory’s explicit instruction to assume targeting rather than assess it applies to a broad supplier population, including second- and third-tier industrial suppliers who may not consider themselves in scope.

For a Microsoft 365 and Azure-centric estate, the exposure is concentrated in three places: internet-facing authentication endpoints subject to password spray; mailbox permission structures, which are rarely monitored and provide malware-free persistence; and any camera, building management or physical security system reachable from the internet.

Additional Hunt Hypotheses

■ Inference service egress from non-development endpoints. Outbound connections to public model-hosting or inference application programming interfaces from hosts with no developer or data science function. This is the durable behavioural signature of model-assisted tooling and will outlive any specific implant.

■ Native utility credential access. Directory database extraction utilities and event log utilities executing outside of documented administrative processes.

■ Camera and building system exposure. Enumerate every streaming-protocol and web-managed physical security device with a route to the internet. Treat default credentials on these as a critical finding, not a low-severity one.

■ Wireless trust assumptions. Review whether any network access control policy grants privilege on the basis of wireless association alone. The proximity attack defeats exactly that assumption.

ASSESSED with HIGH confidence that APT28 will sustain operations against Western logistics, transportation and defence-adjacent technology suppliers regardless of developments in Ukraine, because the collection requirement is strategic rather than tactical. ASSESSED as LIKELY that model-assisted tooling appears in further APT28 operations during 2027, and that its principal effect on defenders is degradation of static signature yield and of authorship attribution.

Cozy Bear · Midnight Blizzard · The Dukes — SVR

THREAT LEVEL: CRITICAL

Sponsor

SVR — Foreign Intelligence Service

Mandate

Strategic intelligence collection; supply chain and cloud tenancy access

Active Since

At least 2008

MITRE ID

G0016

Attribution Confidence

HIGH — multiple allied government attributions

Primary Targeting

Government, diplomatic, defence, technology providers, managed service providers

Distinguishing Trait

Highest operational security of any Russian set; does not maintain hacktivist fronts

OBSERVED: attributed to the SVR by the United States, United Kingdom and allied governments. MITRE tracks the set as G0016. Sub-clusters are tracked separately by Microsoft under storm designations, including the cluster responsible for the 2026 captive-portal campaign.

ASSESSED with HIGH confidence that APT29 is the most disciplined Russian intrusion set and the one least likely to produce noisy indicators. Unlike the GRU, the SVR does not operate hacktivist fronts, does not claim operations, and does not conduct destructive activity. Every observable is a collection observable.

OBSERVED: in the January 2024 compromise of a major technology vendor, the actor obtained initial access through password spray against a legacy non-production account lacking multifactor authentication, then leveraged an existing test application with elevated permissions to grant itself access to corporate mailboxes, and subsequently to source code repositories. No malware was required at any stage.

ASSESSED with HIGH confidence that this is the defining APT29 pattern and that it generalises: legacy authentication surface provides entry, application and service principal permissions provide privilege, and native platform capability provides collection. ASSESSED that endpoint detection provides negligible coverage against this chain and that identity and application telemetry is the decisive control surface.

OBSERVED: from early May 2026, manipulation of domain name resolution and web traffic on captive portal networks at hotels and conference venues across multiple countries, attributed by Microsoft to a Midnight Blizzard sub-cluster. Victims connecting to venue wireless were redirected to fraudulent software update prompts and spoofed sign-in pages designed to harvest credentials.

ASSESSED with HIGH confidence that this campaign targets travelling executives, diplomats and delegates at specific events rather than opportunistic victims, and that venue selection is driven by attendee lists. This is a materially underappreciated exposure for any organisation whose leadership attends international industry conferences.

OBSERVED: sustained use of authentication flows that produce legitimate tokens without credential capture — device code authentication abuse, and application consent phishing in which the victim grants a malicious application persistent delegated access. ASSESSED that these techniques are specifically selected because they survive password rotation and are invisible to controls oriented around credential compromise.

Correction Carried Forward

The Zimbra Collaboration Suite campaign and the associated custom collection capability are not APT29 activity. That campaign belongs to Void Blizzard, covered at Dossier 11. Conflating the two produces incorrect victimology, incorrect tooling attribution and incorrect defensive prioritisation.

ASSESSED relevance to an organisation with an Azure and Microsoft 365-centric estate: CRITICAL, and higher than any other actor in this assessment. Every technique in the table above operates natively against that estate. Three exposures warrant specific attention:

■ Service principals and application registrations. Most enterprises cannot enumerate which applications hold which graph permissions, who owns them, or when credentials were last added. This is the single largest blind spot in the average cloud tenancy.

■ Delegated administration relationships. Managed service provider and reseller relationships frequently carry standing privileged access to the customer tenancy with weak conditional access enforcement on the provider side.

■ Travelling personnel. The captive portal campaign places executive travel directly in scope. Conference attendance by leadership is a targeting signal.

Control Recommendations

1. Enforce phishing-resistant authentication for all privileged and all internet-facing accounts. Hardware-backed authenticators defeat both the captive-portal harvesting and the adversary-in-the-middle patterns; one-time-code and push-based factors do not.

2. Eliminate legacy authentication entirely. Every documented APT29 entry point of the last three years has involved an authentication path that predates modern conditional access.

3. Inventory and govern application registrations. Establish ownership, review graph permissions against business need, alert on credential addition, and prohibit user consent to unverified multi-tenant applications.

4. Enable token protection and continuous access evaluation. Token binding is the control that renders stolen session material useless.

5. Issue travel guidance covering venue wireless. Corporate virtual private network before any authentication, no software updates on untrusted networks, and no certificate warning acceptance under any circumstances.

ASSESSED with HIGH confidence that APT29 will continue to prioritise cloud identity, federated trust and service provider relationships over endpoint compromise, because that tradecraft has proven both effective and difficult to detect. ASSESSED as VERY LIKELY that further supply chain compromise of technology or managed service providers is attempted during 2026 and 2027; the strategic return on a single provider compromise is unmatched by any other access method available to the service.

Secret Blizzard · Venomous Bear · Snake · Uroburos — FSB Centre 16

THREAT LEVEL: CRITICAL

Sponsor

FSB Centre 16 — signals intelligence directorate

Mandate

Elite, low-volume strategic espionage against diplomatic and defence targets

Active Since

At least 2004 — the longest continuously running set in this assessment

MITRE ID

G0010

Attribution Confidence

HIGH — multiple allied government attributions; European Union condemnation

Primary Targeting

Foreign ministries, embassies, defence establishments, research institutions

Distinguishing Trait

Hijacks other actors’ infrastructure and tooling to misdirect attribution

OBSERVED: attributed to FSB Centre 16 by allied governments; the European Union has publicly condemned the centre’s operations. MITRE tracks the set as G0010. A prior United States law enforcement operation disrupted the actor’s flagship peer-to-peer implant network using a purpose-built neutralisation tool.

Analytic Note — Two Clusters, One Centre

FSB Centre 16 houses at least two operationally distinct activity sets: the Turla espionage set described here, and a separate cluster focused on persistent access to critical infrastructure network devices, tracked variously as Berserk Bear, Dragonfly, Energetic Bear and Static Tundra. The July 2026 joint advisory on network device exploitation concerns the latter. Attributing that advisory to Turla is a common and consequential error — the victimology, tooling and objectives differ substantially.

OBSERVED: Microsoft reporting of July 2025 documented interception conducted at the internet service provider or telecommunications level inside Russia, leveraging the domestic lawful intercept apparatus, against foreign embassies in Moscow. Victim systems were redirected to attacker-controlled content and served an implant that installed a rogue trusted root certificate while masquerading as an antivirus product update.

ASSESSED with HIGH confidence that this represents a qualitatively different capability from conventional adversary-in-the-middle phishing: it requires cooperation from, or access to, national telecommunications infrastructure, and it defeats certificate validation for all subsequent traffic from the affected device. ASSESSED that any device operated on Russian domestic networks by a Western organisation should be treated as compromised and should never be reconnected to a corporate network.

OBSERVED: Google Threat Intelligence Group reporting of June 2026 documented a previously undisclosed managed-code backdoor, in development since late 2022, deployed against government and military organisations in Ukraine and against entities with an interest in Italian foreign policy. Early sample metadata additionally implicates targets in the Netherlands, Poland and Germany.

OBSERVED architecture: a multi-component design comprising an orchestrator, a tunnelling component, an information-gathering component and a downloader, using secure web socket transport for command and control. The family shares an obfuscation implementation and significant code with the actor’s established backdoor lineage. Delivery was observed through malicious remote desktop configuration files in early 2025 and, as recently as November 2025, through archive files exploiting the WinRAR extraction flaw.

OBSERVED: vendor reporting of September 2025 documented, at high confidence, the use of Gamaredon tooling to deploy and in at least one case to restore a Turla implant on selected high-value Ukrainian hosts between February and June 2025.

ASSESSED with MODERATE confidence that this constitutes deliberate inter-service or intra-service cooperation rather than opportunistic infrastructure theft, on the basis that the deployments were selective and targeted rather than broad. ASSESSED that the defensive implication is significant: a Gamaredon infection on a high-value host should now be triaged as potential precursor to a far more capable intrusion, not dismissed as commodity noise.

ASSESSED relevance to a typical industrial manufacturer: MODERATE and conditional. Turla selects a small number of high-value targets and does not conduct opportunistic operations. Relevance rises materially where the organisation holds defence contracts, participates in export-controlled research, maintains offices in states of foreign policy interest, or employs personnel who travel to or operate devices on Russian domestic networks.

ASSESSED that the more broadly applicable exposure is network device hygiene arising from the adjacent Centre 16 critical-infrastructure cluster, which is addressed in the recommendations below and applies to every organisation regardless of sector.

Network Device Hardening — Applies to All Organisations

The July 2026 joint advisory documents abuse of simple network management protocol community strings and legacy configuration-copy functionality to extract device configurations to attacker infrastructure over trivial file transfer protocol, with occasional exploitation of a long-known device management vulnerability and of an end-of-life flaw added to the exploited vulnerabilities catalogue on the same date.

1. Disable legacy device management protocols. Smart Install and comparable zero-touch provisioning services should be disabled on every device where they are not in active, documented use.

2. Eliminate version one and version two community-string management. Migrate to version three with authentication and privacy. Community strings are transmitted in clear text and are routinely default.

3. Block trivial file transfer protocol and device management ports at the perimeter. Configuration exfiltration depends on outbound reachability.

4. Enforce modern password hashing on device configurations. Legacy hash types in an exfiltrated configuration are recoverable offline in minutes.

5. Scan for the named device management vulnerability across the estate. This flaw has been exploited continuously since 2021 and remains present in a substantial installed base.

ASSESSED with HIGH confidence that Turla will remain the most difficult Russian intrusion set to detect through conventional means, because its operational tempo is deliberately low and its infrastructure practices are designed to defeat clustering. ASSESSED as LIKELY that further interception-based operations are conducted against Western diplomatic and commercial personnel operating on Russian domestic networks. ASSESSED with MODERATE confidence that the tooling relationship with the higher-tempo Centre 18 set continues, and that this relationship represents the most productive current detection opportunity against Turla — catching it downstream of a noisier partner.

Shuckworm · Primitive Bear · Aqua Blizzard · Armageddon — FSB Centre 18

THREAT LEVEL: HIGH

Sponsor

FSB Centre 18; operators publicly identified as officers based in occupied Crimea

Mandate

High-volume espionage against Ukrainian government, military and critical sectors

Active Since

2013

MITRE ID

G0047

Attribution Confidence

HIGH — Ukrainian security service named individual officers

Primary Targeting

Ukraine overwhelmingly; military missions in Ukraine; NATO border states secondarily

Distinguishing Trait

Highest operational tempo of any actor in this assessment; deliberately disposable tradecraft

OBSERVED: the Ukrainian security service publicly attributed the group to FSB Centre 18 and named individual officers operating from occupied Crimea, many of them former Ukrainian security service personnel who defected in 2014. Thousands of attacks and hundreds of discrete incidents have been attributed by Ukrainian authorities. MITRE tracks the set as G0047.

ASSESSED with HIGH confidence that Gamaredon is deliberately non-stealthy. Infrastructure is rotated constantly, tooling is rewritten rather than protected, and detection is treated as an acceptable cost of throughput. ASSESSED that conventional indicator-based defence is structurally ineffective against this model and that behavioural detection is the only viable approach.

OBSERVED: a campaign against a Western country’s military mission in Ukraine, beginning with an infected removable drive and proceeding through a scripted information stealer that used a public writing platform for exfiltration and maintained persistence in registry-resident script form rather than on disk.

OBSERVED: reconstructed infection chains from early 2026 beginning with weaponised markup documents that deliver archives exploiting the WinRAR extraction flaw, dropping a scripted application into the startup folder for execution via a native scripting host, followed by the group’s established loader and stealer families.

OBSERVED: a destructive capability introduced in late 2025, representing the group’s first documented departure from pure collection. ASSESSED with MODERATE confidence that this reflects tasking change rather than capability development, given that the destructive component is unsophisticated relative to the group’s collection tooling.

OBSERVED: mobile surveillance families attributed to the group targeting Russian-speaking populations in Central Asia. One family name carried in prior reporting could not be corroborated and is marked unconfirmed; a second appears to be a misrendering of a corroborated family.

OBSERVED: the archive extraction flaw exploited by Gamaredon is a path traversal issue abusing alternate data streams, discovered during active zero-day exploitation, patched in mid-2025 and placed in the Known Exploited Vulnerabilities catalogue with a September 2025 remediation deadline. The identifier and description carried in prior reporting are confirmed accurate.

Cross-Actor Exploit Proliferation — A Structural Finding

This single archive vulnerability has been documented in the hands of a financially motivated Russia-aligned actor that exploited it first as a zero-day, the GRU’s destructive unit, an FSB elite espionage set, and an FSB high-tempo collection set — within months of one another, and with continued exploitation observed into 2026. ASSESSED with MODERATE confidence that this reflects a shared exploit supply chain across the Russian ecosystem rather than four independent discoveries. The defensive consequence is direct: patching latency on widely deployed client-side software is exploited by the entire ecosystem simultaneously, and this specific flaw remains exploited well over a year after patch availability.

ASSESSED relevance to a United States industrial manufacturer: LOW to MODERATE, and conditional on Ukrainian presence. The actor’s targeting is overwhelmingly Ukraine-focused. Relevance rises where the organisation maintains Ukrainian operations, staff or suppliers, or exchanges removable media with Ukrainian entities.

ASSESSED with MODERATE confidence, however, that the more consequential finding for all organisations is the tooling relationship with Turla. A Gamaredon detection on a host of genuine intelligence value should be escalated, not closed as commodity.

Additional Hunt Hypotheses

■ Command and control over consumer messaging and publishing platforms. Egress to messaging platform application programming interfaces, public paste and writing services, and commercial tunnelling endpoints from hosts with no business justification.

■ Removable media execution. Shortcut file execution originating from removable volumes, and script interpreters spawned by removable media autorun paths.

■ Registry-resident script storage. Unusually large registry values containing encoded script content, and scripting hosts reading from registry paths at logon.

■ Patch state on client-side archive and productivity software. Verify enterprise-wide remediation of the archive extraction flaw. This is frequently unmanaged software installed outside of the software asset inventory.

ASSESSED with HIGH confidence that Gamaredon operational tempo against Ukraine continues without material change. ASSESSED as LIKELY that the group expands operations against NATO border states — a trajectory already visible in its targeting of military missions and diplomatic entities. ASSESSED with MODERATE confidence that the introduction of destructive capability signals broadened tasking rather than a doctrinal shift, and that collection remains the group’s primary function.

CARR · assessed alias of Z-Pentest — a GRU-created hacktivist front

THREAT LEVEL: HIGH

Sponsor

GRU Unit 74455 — asserted in a United States indictment as founded, funded and directed

Mandate

Deniable disruption; operational technology intrusion for psychological and propaganda effect

Active Since

Early 2022

Attribution Confidence

HIGH — Treasury designations 2024; indictment and extradition December 2025

Primary Targeting

Water and wastewater, energy, food and agriculture in the United States and Europe

Distinguishing Trait

The best-documented case of an intelligence service creating a hacktivist persona

OBSERVED: in July 2024 the United States Treasury designated two individuals associated with the group, identifying one as its leader and the other as its primary technical operator. The designation text references manipulation of human-machine interfaces at Texas water facilities and the resulting loss of tens of thousands of gallons of water. It also records the assessment that major damage had been avoided principally because of the group’s limited technical sophistication.

OBSERVED: in December 2025, a United States indictment charged a further individual, who was extradited. The indictment asserts that the group was founded, funded and directed by the GRU, and treats a second well-known hacktivist brand as an alias of the same entity. OBSERVED separately: prior vendor reporting assessed at moderate to high confidence that the persona was created and directed by the GRU’s destructive unit, noting that the persona had on occasion disclosed operational details in advance of the unit’s own activity and had published data obtained during that unit’s intrusions.

ASSESSED with HIGH confidence that claims made by this persona should be read as attributable to the sponsoring unit rather than to volunteers, and that the persona exists to provide deniability rather than to conduct independent operations.

OBSERVED: the group’s methodology is elementary. Internet-facing remote access services associated with operational technology are located through public scanning services and network scanners, accessed using default or weak credentials or through unauthenticated exposure, and manipulated directly through the human-machine interface. There is no exploit development, no custom tooling and no lateral movement in the conventional sense.

ASSESSED with HIGH confidence that this actor possesses no capability to overcome basic remote-access hygiene, and correspondingly that the entire threat surface it represents can be eliminated by a single control. That is an unusual and valuable property in a threat assessment: the mitigation is complete, cheap and permanent.

ASSESSED relevance to a United States industrial manufacturer with operational technology exposure: HIGH and immediate. This is the actor most likely to produce an unplanned outage at a mid-market industrial facility, precisely because it requires no sophistication — only an exposed interface. Food and agriculture processing, water treatment associated with industrial processes, and building or facility control systems are all in documented scope.

ASSESSED that the risk is not espionage or extortion but operational disruption, product loss and safety consequence, with an accompanying publicity campaign. The November 2024 food processing incident — spoilage, chemical release and evacuation — is the model case for what this actor can produce at a manufacturing site.

1. Enumerate and eliminate every internet-reachable remote access service with a path to operational technology. Virtual network computing on the standard port range, remote desktop, web-based operator interfaces, and vendor remote support tooling. Verify externally using public scanning services rather than relying on internal firewall documentation, which is routinely inaccurate.

2. Require authenticated, multifactor-protected remote access for all operational technology support. Vendor access is the most common exception and the most common failure.

3. Replace all default and shared credentials on operator interfaces and field devices. Where a device cannot support unique credentials, it must not be reachable from any routable network.

4. Alert on operator interface access outside of shift patterns and from unexpected sources. Human-machine interface authentication is low-volume and highly patterned, which makes anomaly detection unusually reliable in this environment.

5. Implement out-of-band monitoring of physical process parameters. Tank levels, temperatures and pressures should be observable through a path that does not depend on the same control system an intruder would manipulate.

ASSESSED with MODERATE confidence that the persona’s public visibility has declined following designation, indictment and extradition, but that the underlying capability and tasking persist under this or successor branding. ASSESSED as LIKELY that opportunistic operational technology intrusion against poorly secured Western utilities and industrial facilities continues throughout 2026 and 2027, because the required capability is trivial and the propaganda return is high. ASSESSED with HIGH confidence that organisations maintaining basic remote-access hygiene face effectively zero residual risk from this actor.

Operational-technology-focused hacktivist collective; parent of Sector16

THREAT LEVEL: HIGH

Sponsor

Disputed — see analytic note below

Mandate

Operational technology intrusion for propaganda effect; explicitly avoids denial-of-service

Active Since

September 2024

Attribution Confidence

MODERATE — conflicting open-source and legal characterisations

Primary Targeting

Water and wastewater, energy, food and agriculture across NATO members

Distinguishing Trait

The only pro-Russia hacktivist group to specialise in intrusion rather than disruption

Unresolved Attribution — Recorded as an Intelligence Gap

Two credible but incompatible characterisations exist. Open-source reporting describes Z-Pentest as an independent splinter formed in September 2024 by CARR administrators dissatisfied with the level of GRU funding and support, joined by at least one administrator from a separate hacktivist network, and claiming a Balkan base. The December 2025 United States indictment instead treats Z-Pentest as an alias of CARR and asserts continuing GRU direction. ASSESSED with MODERATE confidence that persona migration and rebranding — with continuity of personnel and at least intermittent continuity of sponsorship — reconciles the two better than either a clean split or a simple alias relationship. This is recorded as a formal collection gap at Annex C.

OBSERVED: named in the December 2025 joint advisory issued with eighteen international partners as a primary operational technology intrusion threat, alongside CARR, a subordinate group it created, and a separate denial-of-service network. The advisory documents pro-Russia hacktivists reaching operational technology in water and wastewater, food and agriculture, and energy environments through internet-facing virtual network computing services, using public scanning services and network scanners for reconnaissance and virtual private server infrastructure for credential brute force.

OBSERVED: the group publishes video evidence of operator interface access and manipulation as its principal propaganda output, and has been observed coordinating its claims with the campaign hashtags of a larger denial-of-service network — an indicator of ecosystem coordination rather than independence.

OBSERVED: creation in January 2025 of a subordinate group composed of less experienced operators, which posts claims of United States energy infrastructure compromise. ASSESSED with MODERATE confidence that this functions as a recruitment and training pipeline, and that its claims warrant lower credence than the parent group’s.

Tradecraft is materially identical to that described in Dossier 06 and is not repeated in full. The distinguishing characteristics are a deliberate preference for intrusion over denial-of-service, a focus on capturing visual evidence of process manipulation, and slightly broader reconnaissance discipline — the group demonstrates systematic scanning rather than purely opportunistic discovery.

ASSESSED relevance to a United States industrial manufacturer: HIGH, identical in character to CARR. The mitigation set at Dossier 06 applies without modification and is complete against this actor as well. No additional controls are required specifically for Z-Pentest.

ASSESSED with HIGH confidence that the aggregate hacktivist operational technology threat — CARR, Z-Pentest, the subordinate group and the wider claimed alliance — is fully addressed by elimination of internet-facing remote access to operational technology, unique authenticated credentials on operator interfaces, and out-of-band process monitoring. Organisations should resist the temptation to treat each named group as a separate defensive problem; they share one attack path.

ASSESSED as LIKELY that this actor and its subordinate continue opportunistic operational technology intrusion throughout 2026, and VERY LIKELY that claimed impact continues to exceed actual impact by a wide margin. ASSESSED with MODERATE confidence that the group’s propaganda value to the Russian state exceeds its operational value, and that this — rather than any technical capability — is the reason it persists.

The DDoSia network — the most prolific pro-Russia disruption operation

THREAT LEVEL: MODERATE

Sponsor

State-tolerated; specific institutional sponsorship UNCONFIRMED at primary-source level

Mandate

Distributed denial-of-service against European government, financial and transport targets

Active Since

March 2022

Attribution Confidence

HIGH on operations; MODERATE on sponsorship

Primary Targeting

European Union member states, NATO institutions, election and summit events

Distinguishing Trait

Crowdsourced attack tooling with cryptocurrency incentives for volunteer participants

OBSERVED: European law enforcement characterises the group as a crowdsourced pro-Russian cybercrime network with an estimated four thousand supporters recruited through ideologically aligned channels, forums and chat groups. During the July 2025 disruption operation, authorities warned more than one thousand supporters and a smaller number of administrators of criminal liability through direct messaging.

OBSERVED: the group distributes a purpose-built attack tool that allows volunteers to contribute bandwidth against centrally distributed target lists, with cryptocurrency rewards for the highest-contributing participants. The tool has been hosted on mainstream code hosting platforms.

ASSESSED: prior reporting linking the group to a specific Kremlin-affiliated youth-monitoring organisation appears in credible vendor research but has not been asserted in any government advisory, indictment or designation. It is retained as reported but marked UNCONFIRMED. ASSESSED with MODERATE confidence that the group operates with state tolerance and informal encouragement rather than direct tasking.

OBSERVED: a coordinated European law enforcement operation in July 2025 disrupted more than one hundred servers, produced two arrests, seven arrest warrants, twenty-four searches and questioning of a further group of individuals across six countries, with two Russia-based principals named as the main instigators and several individuals added to a European most-wanted list.

OBSERVED: the group continued operating at approximately ten targets per day during the disruption operation itself, and publicly dismissed the action. Vendor tracking covering the year to mid-2025 records approximately four and a half thousand attacks, with one European country struck more than three hundred and sixty times and European Union and NATO-affiliated institutions among the impacted entities.

OBSERVED: December 2025 United States charges relating to the group, and suspension of its primary social media presence. Charging documents reference more than fifteen hundred attacks between March 2022 and June 2025.

The Takedown Lesson

ASSESSED with HIGH confidence that this case demonstrates the structural resilience of crowdsourced attack networks. Server seizure removes coordination infrastructure that can be rebuilt in days; arrests remove participants from a pool of thousands; and brand suspension is answered by migration to a new channel. Defenders should treat law enforcement announcements as attribution intelligence, not as risk reduction, and should not adjust denial-of-service posture on the strength of a takedown.

ASSESSED relevance to a United States industrial manufacturer: LOW to MODERATE, and limited to availability and reputation. The group has occasionally claimed critical infrastructure intrusion following the July 2025 disruption — claims involving water utilities and industrial boiler systems in several European countries — but ASSESSED with MODERATE confidence that these claims are substantially inflated and that the group’s demonstrated capability remains denial-of-service.

ASSESSED that targeting is driven by national policy alignment rather than by organisational characteristics: an organisation becomes a target because of the country it operates in and the position that country has taken, not because of anything about the organisation itself. Public-facing web properties, customer portals and supplier portals are the exposed surface.

■ Ensure content delivery and application-layer denial-of-service protection is in enforcing mode for all internet-facing properties. Many organisations run such services in monitoring mode indefinitely.

■ Rate-limit and challenge at the application layer. This group’s primary method is application-layer request flooding, which volumetric protections alone do not address.

■ Monitor adversary target-list channels for pre-attack warning. Target lists are distributed publicly in advance, which provides a genuine and unusual early-warning opportunity.

■ Treat published client fingerprints as perishable. User agent strings and transport fingerprints for the volunteer client rotate frequently and should not anchor a detection strategy.

ASSESSED as VERY LIKELY that the group continues operating at comparable tempo through 2026, with targeting keyed to European political events, elections, summits and announcements of assistance to Ukraine. ASSESSED as UNLIKELY that the group develops genuine intrusion capability; ASSESSED as LIKELY that it continues to claim intrusions it has not achieved.

Storm-0978 · Void Rabisu · Tropical Scorpius · TA829 — hybrid espionage and extortion

THREAT LEVEL: HIGH

Sponsor

Russia-aligned; direct state control UNCONFIRMED

Mandate

Dual-track: intelligence collection aligned with state interests, plus financially motivated extortion

Active Since

At least 2022

Attribution Confidence

MODERATE — Russia alignment well supported; institutional relationship not established

Primary Targeting

Defence, government, manufacturing, logistics and finance in Europe and North America

Distinguishing Trait

Serial zero-day exploitation by an actor that also runs ransomware

OBSERVED: the actor is tracked under at least six vendor designations, reflecting genuine analytic disagreement about its nature. It has conducted espionage operations against NATO-adjacent and Ukrainian government targets while simultaneously operating ransomware and extortion activity.

ASSESSED with MODERATE confidence that the actor operates with tolerance rather than direction — permitted to pursue financial objectives in exchange for availability and for collection aligned with state interests. ASSESSED with LOW confidence on any specific institutional relationship; no government has publicly attributed the actor to a service.

ASSESSED with HIGH confidence that the more important analytic point is not the attribution question but its consequence: this actor demonstrates that the categories “criminal” and “espionage” do not partition the Russian ecosystem. An extortion incident involving this actor may also be a collection operation, and incident response scoping should reflect that.

OBSERVED: the actor has exploited multiple zero-day vulnerabilities across successive years — a productivity suite remote code execution flaw in 2023, a browser and mail client memory safety flaw chained with a Windows privilege escalation flaw in late 2024, and the archive extraction path traversal flaw in 2025, which it exploited before any other documented actor.

ASSESSED with MODERATE confidence that this represents either in-house exploit development capability or privileged access to an exploit supplier, and that either explanation places the actor above the capability tier normally associated with financially motivated operations. ASSESSED that the actor’s first-mover position on the archive flaw, subsequently adopted by three state sets, is consistent with the shared supply chain hypothesis advanced at Dossier 05.

OBSERVED infrastructure practice: use of proxy services deployed on compromised network edge devices — particularly a widely deployed router platform — to provide upstream relay capacity. This pattern is shared with an overlapping cluster tracked separately by at least one vendor, and ASSESSED with MODERATE confidence to indicate a shared infrastructure provider rather than a single operator.

ASSESSED relevance to a United States industrial manufacturer with international offices: HIGH and direct. This is one of the few actors in this assessment whose documented victimology explicitly and repeatedly includes manufacturing. Recruitment-themed spearphishing against European and Canadian targets in the manufacturing, defence and logistics sectors is documented within the last twelve months.

ASSESSED that the exposure is concentrated in unmanaged client-side software — archive utilities, browsers and mail clients installed outside software asset management — and in human resources and recruitment mailboxes, which by function must open unsolicited attachments from unknown senders.

Additional Hunt Hypotheses

■ Decoy document display on first execution. A loader that opens a plausible document immediately after execution is a strong behavioural signature and is not commodity behaviour.

■ Edge device relay traffic. Persistent outbound sessions to consumer or small-business router address space, particularly on non-standard ports.

■ Client-side software inventory completeness. Determine whether archive utilities, browsers and mail clients are in the software asset inventory at all. In most industrial enterprises, at least one is not.

ASSESSED with MODERATE confidence that this actor continues dual-track operations without meaningful separation between its espionage and financial activity. ASSESSED as LIKELY that it exploits at least one further zero-day vulnerability in widely deployed client-side software during 2026 or 2027, based on a consistent annual cadence over three years. ASSESSED with HIGH confidence that manufacturing remains in scope.

A GRU front persona for destructive operations

THREAT LEVEL: CRITICAL

Sponsor

GRU Unit 74455 — formally linked by vendor attribution

Mandate

Public claiming of destructive operations conducted by the sponsoring unit

Active Since

2022

Attribution Confidence

HIGH on the front relationship

Primary Targeting

Ukrainian telecommunications and critical services

Distinguishing Trait

Named after a Russian thermobaric weapon system — not a persona designed to resemble volunteers

OBSERVED: the persona has been formally linked to the GRU’s destructive unit by vendor attribution and is used to claim operations publicly. Unlike personas constructed to resemble grassroots hacktivism, this one takes its name from a Russian thermobaric artillery system — an intentional signal of state association rather than an attempt at deniability in the conventional sense.

ASSESSED with HIGH confidence that any operation claimed by this persona should be treated as a GRU operation for the purposes of attribution, response and reporting. ASSESSED that its function differs from that of the water-utility-focused persona at Dossier 06: where that persona provides deniability for low-sophistication opportunistic activity, this one provides public claiming for high-consequence destructive operations that the state wishes to be understood as Russian while retaining formal deniability.

OBSERVED: on 12 December 2023 a destructive operation against Ukraine’s largest mobile network operator destroyed approximately ten thousand computers and more than four thousand servers, along with cloud storage and backup systems. Mobile and internet services were disrupted nationwide. Air raid warning systems in at least two cities were rendered inoperative. Recovery cost was reported at approximately ninety million dollars. Ukrainian officials subsequently stated that the intruders had maintained access for months prior to the destructive action.

OBSERVED: the persona claimed the operation within twenty-four hours.

The Analytic Pattern

ASSESSED with HIGH confidence that rapid public claiming following a destructive operation is a deliberate GRU signalling practice rather than operational carelessness. The pattern — long covert access, coordinated destruction of both production and recovery infrastructure, disabling of emergency alerting, then immediate public claiming through a state-associated persona — recurs across the unit’s operations. The destruction of backups alongside production systems is the operationally decisive element and should shape recovery architecture assumptions: an adversary with months of access will find and destroy any recovery capability reachable from the production network.

ASSESSED relevance to a United States industrial manufacturer: indirect but instructive. The persona itself presents no distinct threat; the sponsoring unit is covered at Dossier 01. The operational lesson is directly applicable and is the reason this persona is retained as a separate entry:

■ Recovery infrastructure reachable from production is not recovery infrastructure. Backups, backup catalogues, virtualisation management and cloud storage were all destroyed in the same operation. Immutable, offline or physically separated copies are the only architecture that survives this adversary.

■ Emergency and safety systems are explicit targets. Alerting and warning capability was deliberately disabled. In an industrial context this maps directly to safety instrumented systems, emergency notification and evacuation alerting.

■ Months of dwell should be the planning assumption. Detection engineering calibrated to catch an intrusion within days is calibrated for the wrong adversary.

ASSESSED with HIGH confidence that this persona remains available for use following future destructive operations. ASSESSED that its reappearance should be treated as a high-confidence indicator of GRU destructive activity and as a trigger for elevated monitoring across sectors matching the claimed target profile.

A GRU front persona for destructive operations

THREAT LEVEL: CRITICAL

Sponsor

GRU Unit 74455 — formally linked by vendor attribution

Mandate

Public claiming of destructive operations conducted by the sponsoring unit

Active Since

2022

Attribution Confidence

HIGH on the front relationship

Primary Targeting

Ukrainian telecommunications and critical services

Distinguishing Trait

Named after a Russian thermobaric weapon system — not a persona designed to resemble volunteers

OBSERVED: the persona claimed the operation within twenty-four hours.

The Analytic Pattern

■ Months of dwell should be the planning assumption. Detection engineering calibrated to catch an intrusion within days is calibrated for the wrong adversary.

ASSESSED relevance to a United States industrial manufacturer with an Azure and Microsoft 365-centric estate: CRITICAL. The tradecraft is precisely aligned to that estate, and the information-stealer-to-session-replay bridge is an exposure most enterprises do not monitor at all. Any organisation that operates a secondary collaboration or webmail platform — commonly retained from an acquisition or for a specific business unit — should treat that platform as a priority review item.

Control Recommendations

1. Enable token protection and continuous access evaluation. Session binding is the only control that reliably defeats cookie replay.

2. Treat information-stealer detections as identity incidents. On any stealer detection, revoke all sessions for the affected principal immediately. Password reset alone does not invalidate stolen session material.

3. Bring secondary and legacy collaboration platforms into monitoring scope. Confirm patch state on any non-primary webmail or collaboration deployment, including the vulnerability referenced in the July 2026 advisory.

4. Baseline and alert on programmatic mailbox access volume. Application-based mailbox access is legitimate and common; the detectable anomaly is volume and breadth, not the access method itself.

ASSESSED with HIGH confidence that this actor continues high-volume collection against NATO government, defence and industrial targets through 2026 and 2027. ASSESSED as LIKELY that further zero-day exploitation of secondary collaboration and webmail platforms occurs, on the basis that the actor has demonstrated both the capability and a preference for platforms outside mainstream security monitoring. ASSESSED with MODERATE confidence that continued reliance on criminal-market session material persists, given its efficiency and low attribution cost.

The following actors are not included in the top ten but have credible claims to inclusion. Two of them, in this assessment’s judgement, displace conventional entries. Each is summarised with the argument for and against elevation.

OBSERVED: in September 2024 the United States charged five officers of this unit together with one civilian over destructive operations against Ukraine and targets in more than two dozen NATO countries, with a substantial reward offered for information. Public reporting characterises the cyber element as a small team of junior officers within a specialist training centre, operating from dedicated premises and relying substantially on non-governmental criminal contractors for capability.

ASSESSED with HIGH confidence that this unit warrants elevation into a top ten. Its distinguishing characteristic is a combined physical and cyber sabotage mandate: the same unit is associated with attempted physical sabotage, assassination and destabilisation operations across Europe. ASSESSED that this fusion of kinetic and cyber tasking under a single command represents a qualitatively different risk profile from any other actor in this assessment, and that its absence from most Russian threat assessments reflects its low operational volume rather than low consequence.

ARGUMENT FOR ELEVATION

Indictment-backed attribution; destructive mandate; documented willingness to operate inside NATO territory; unique physical-plus-cyber fusion. Displaces the residual denial-of-service brands on consequence alone.

OBSERVED: attributed to the FSB; tracked by MITRE as a distinct group. Following public exposure of one implant family in May 2025, the actor abandoned that tooling within days and deployed a succession of replacement backdoors in different languages, delivered through a fraudulent verification prompt that induces the victim to execute code themselves. Targeting focuses on non-governmental organisations, policy institutes, diplomats, journalists and individuals connected to Ukraine, with documented abuse of linked-device features in mainstream messaging applications.

ASSESSED with HIGH confidence that the retooling speed observed after exposure — days, not months — is the most operationally significant characteristic of this actor and indicates a mature development pipeline held in reserve. ASSESSED that the fraudulent verification prompt technique is now the single most prolific initial access method across the wider threat landscape, and that this actor’s use of it in a targeted intelligence context deserves more attention than it receives.

ARGUMENT FOR ELEVATION

Demonstrated rapid retooling capability; adoption of the dominant social engineering technique of the period; direct targeting of the civil society and policy community. Displaces a residual hacktivist brand.

OBSERVED: in October 2024 the United Kingdom, United States and Australia took coordinated action against this syndicate, with the United Kingdom designating sixteen individuals. The National Crime Agency reporting accompanying that action states that a former senior FSB official, related by marriage to the group’s leadership, acted as a key enabler of the group’s relationship with the Russian intelligence services, and that prior to 2019 the group had been tasked to conduct cyber attacks and espionage operations against NATO allies. One designated individual was separately identified as an affiliate of a major ransomware operation, linked to attacks against more than sixty victims. The reporting states that the group extorted at least three hundred million dollars from victims including healthcare, critical national infrastructure and government entities.

ASSESSED with HIGH confidence that this is the best-documented bridge between the Russian criminal ecosystem and the intelligence services, and that it provides the evidentiary basis for treating the state-criminal nexus as established policy rather than analytic speculation. ASSESSED that it belongs in any serious assessment of Russian cyber threat even though it is not a state unit.

ARGUMENT FOR INCLUSION

Definitive documentary evidence of state tasking of a criminal syndicate. Its analytic value lies in what it establishes about the ecosystem rather than in its current operational tempo.

OBSERVED: tracked variously as Berserk Bear, Dragonfly, Energetic Bear and under vendor-specific designations, this cluster is the subject of the July 2026 joint advisory on network device exploitation and is separately implicated by national incident reporting in the infrastructure associated with the Poland energy attack.

ASSESSED with MODERATE confidence that this cluster is under-weighted in most assessments because it is routinely conflated with the elite espionage set housed in the same centre. Its mandate — persistent access to critical infrastructure network devices, without immediate effect — is the classic pre-positioning profile and is arguably the most strategically consequential Russian activity currently observable against Western infrastructure.

OBSERVED: a distinct ecosystem of information operations infrastructure operates in parallel with the intrusion sets described above, including networks specialising in inauthentic media properties and fabricated content distribution. ASSESSED that these do not belong in a network intrusion top ten, but that they intersect operationally in two places: hack-and-leak operations, where intrusion product is laundered through influence infrastructure; and the hacktivist personas, whose primary output is narrative rather than effect. Defenders whose organisations could become the subject of a leak operation should treat this as a communications and legal readiness matter as well as a technical one.

Ransomware operations conducted from Russian territory are not a separate problem from state-sponsored activity; they are the periphery of the same system. This section characterises the ecosystem as it relates to state threat rather than providing a comprehensive ransomware assessment.

OBSERVED: leaked internal communications from a major syndicate revealed contact with the security services and an explicit political alignment declaration at the outset of the full-scale invasion. OBSERVED: national law enforcement reporting on a designated syndicate documents tasking by the intelligence services to conduct attacks and espionage against alliance members, enabled by a former senior intelligence official. OBSERVED: designated individuals have moved between syndicates and between criminal and state-aligned activity without apparent consequence.

ASSESSED with HIGH confidence that the relationship is structural and policy-driven. ASSESSED with MODERATE confidence that the practical consequence for defenders is the collapse of the analytic boundary between extortion and collection, and that incident response scoping in defence-adjacent, energy and government-supplier organisations should include a collection hypothesis by default.

Conti

Disbanded 2022

Historically decisive: leaks established service contact; affiliates dispersed into state-aligned activity

Treatment of Forecast Figures

Projections in circulation regarding total ransomware victim counts for 2026, and claims of formal coalition arrangements between named operations, originate in vendor forecasting and in adversary self-declaration respectively. Neither is independently verified. This assessment does not rely on those figures and recommends that they be attributed to the originating vendor and labelled as projection wherever they are reused.

ASSESSED with MODERATE confidence that the following triage rule is warranted for any organisation in a defence-adjacent, energy, government-supplier or critical manufacturing role: where a ransomware incident involves a Russian-speaking operator, scope the investigation for collection indicators — staged archives of engineering or contract documentation, access to identity infrastructure disproportionate to encryption objectives, and dwell time substantially exceeding what encryption alone would require — and not solely for encryption impact and recovery.

Defence and Outlook

Exposure modelling, staged recommendations, forecast and annexes

This section translates the preceding dossiers into a prioritised exposure model for a representative organisation: a United States-headquartered industrial manufacturer with an Azure and Microsoft 365-centric information technology estate, operational technology at multiple production sites, international offices, and a supplier network extending into Europe. The prioritisation below reflects the assessed probability of encountering each actor against the assessed consequence if encountered.

ASSESSED with HIGH confidence that four exposures account for the overwhelming majority of realistic Russian threat surface at such an organisation. Programme effort should be concentrated accordingly rather than distributed evenly across the actor set.

EXPOSURE 1

Internet-facing remote access to operational technology

Actors: CARR, Z-Pentest, subordinate groups, opportunistic ransomware affiliates. This is the highest-likelihood exposure and simultaneously the cheapest to eliminate completely. Virtual network computing, remote desktop, web-based operator interfaces and vendor remote support tooling with any path to production process control. The mitigation is total: these actors possess no capability to overcome authenticated, multifactor-protected remote access.

EXPOSURE 2

Cloud identity, application permissions and session material

Actors: APT29, Void Blizzard, APT28. Service principal credential addition, consent to unverified multi-tenant applications, delegated administration relationships, legacy authentication paths, mailbox permission grants, and replay of session cookies obtained from commodity information stealers. ASSESSED that endpoint detection provides negligible coverage here and that identity telemetry is the decisive control surface.

EXPOSURE 3

Edge and network devices

Actors: Sandworm access development, the FSB critical infrastructure cluster, ransomware affiliates. Virtual private network concentrators, firewalls, routers and remote-access gateways — both as an initial access path and as command and control relay infrastructure. Includes legacy device management protocols and configuration exfiltration. ASSESSED that this is the fastest-growing Russian initial access surface and the one most commonly outside vulnerability management scope.

EXPOSURE 4

Unmanaged client-side software

Actors: RomCom, Gamaredon, Turla, Sandworm. Archive utilities, browsers, mail clients and productivity software installed outside software asset management. The archive extraction flaw discussed throughout this assessment has been exploited by four separate Russian actor tiers and remains exploited more than a year after patch availability, principally because the affected software is frequently unmanaged.

ASSESSED with HIGH confidence that the realistic outage scenarios for such an organisation, ranked by probability, are as follows. This ranking is deliberately at odds with the attention typically given to each scenario.

1. Ransomware affiliate encrypting information technology systems on which production scheduling, quality management and shipping depend, without ever touching the control system. This remains the most probable cause of a production stoppage attributable to a Russian actor.

2. Hacktivist manipulation of an exposed operator interface at a single site, producing a localised process upset, product loss and potentially a safety event, followed by publicity.

3. Collateral impact from a destructive operation against a supplier, logistics provider or utility rather than against the organisation itself.

4. A targeted destructive operation against the organisation directly. ASSESSED as UNLIKELY absent a substantial escalation in the wider conflict, but with catastrophic consequence if it occurs.

Forward-looking judgements are stated with ICD 203 likelihood terms and separate confidence ratings. Each includes the reasoning for the confidence rating and, where relevant, the indicator that would falsify it.

VERY LIKELY

HIGH CONFIDENCE

Destructive operations against European energy infrastructure continue

The Poland attack established a repeatable template: extended information technology dwell, coordinated pivot to operational technology, symbolic timing. Capability is demonstrated, political authorisation is evidently present, and the attack achieved substantial disruption without triggering an alliance response. Confidence is HIGH because the judgement rests on demonstrated capability and demonstrated intent rather than on inference about future decisions.

Falsifying indicator: a sustained absence of destructive activity against European infrastructure through a full winter heating season.

LIKELY

MODERATE CONFIDENCE

Model-assisted tooling moves from experiment toward routine operational use

Two independent data points exist within twelve months: a runtime inference-querying implant attributed to a GRU set, and a wiper assessed by responders as largely model-generated. Confidence is MODERATE rather than HIGH because two observations do not establish a trend and because operator adoption may be slowed by reliability and operational security concerns. The assessed defensive consequence is attribution degradation and reduced static signature yield rather than a step change in destructive capability.

Falsifying indicator: an eighteen-month period with no further documented model-integrated Russian tooling.

LIKELY

MODERATE CONFIDENCE

Hacktivist operational technology intrusion persists despite arrests and designations

The ecosystem is structurally resilient: personnel are fungible, branding is disposable, and required capability is trivial. Designations, indictments and an extradition have not visibly reduced activity. Confidence is MODERATE because the December 2025 enforcement action was more consequential than prior measures and its full effect is not yet observable.

Falsifying indicator: a sustained absence of new operational technology intrusion claims across the persona ecosystem through the remainder of 2026.

ROUGHLY EVEN CHANCE

MODERATE CONFIDENCE

A Ukraine ceasefire redirects rather than reduces Russian offensive cyber activity

ASSESSED that capacity currently committed to Ukrainian targets would be reallocated toward pre-positioning in Western energy, logistics, water and manufacturing networks, and toward collection on alliance decision-making. Rated at roughly even chance because a genuine tempo reduction as part of sanctions relief bargaining remains plausible and has precedent in other domains. Confidence is MODERATE because the outcome turns on political variables not observable through technical collection.

Leading indicator: an increase in access development against Western infrastructure without corresponding effects activity would support the redirection hypothesis.

LIKELY

MODERATE CONFIDENCE

Further zero-day exploitation of widely deployed client-side and collaboration software

Three distinct actors in this assessment have exploited client-side or collaboration platform zero-days within the last twenty-four months, with an observable annual cadence for at least one of them. The economics favour it: a single client-side flaw serves espionage, hacktivist and criminal tiers simultaneously, consistent with the shared supply chain hypothesis advanced in this assessment.

Watch item: secondary and non-mainstream collaboration platforms are disproportionately targeted because they sit outside most monitoring programmes.

UNLIKELY

LOW CONFIDENCE

A deliberate, attributable destructive attack causing sustained physical outage on United States soil

Capability and access are ASSESSED to be present; the limiting factor is escalation calculus. Rated UNLIKELY on the basis of consistent restraint regarding United States infrastructure to date. Confidence is LOW because the judgement depends entirely on political decision-making that could change rapidly and without technical warning, and because the observable indicators of intent would likely be indistinguishable from ordinary access development until the moment of execution.

This is the low-probability, catastrophic-consequence scenario that should drive recovery architecture rather than detection investment.

VERY LIKELY

HIGH CONFIDENCE

Law enforcement action continues without degrading in-country operational tempo

Every disruption operation documented in this assessment was followed by continued activity. Servers are rebuilt, personas migrate, and indicted individuals remain at liberty within Russia. Confidence is HIGH because the pattern is consistent across multiple independent operations over several years. The value of these actions is attribution clarity, coalition signalling and constraint on travel and finance — not capability denial.

Defensive implication: do not adjust posture on the strength of a takedown announcement.

The following developments would each warrant an out-of-cycle reassessment of this document.

■ Resolution of the CARR and Z-Pentest attribution question through court proceedings or further government reporting, which would clarify whether the hacktivist operational technology tier is state-directed or state-tolerated.

■ Any destructive operation inside NATO territory producing sustained loss of supply, which would represent an escalation threshold crossing and would require reassessment of the restraint hypothesis regarding United States infrastructure.

■ Documented state-unit use of model-generated tooling in an effects operation, as distinct from the reconnaissance and wiper use observed to date.

■ Public attribution of the Void Blizzard set to a specific service, which would materially change the assessed intent behind its collection programme.

■ A ceasefire, settlement or major escalation in Ukraine, each of which would alter tasking priorities across all GRU and FSB sets simultaneously.

No posts

The Russian Offensive Cyber Apparatus

Comments