🇷🇺 Russia | Threat Actor Index

Tactic Coverage

Tactics observed across Russia groups

Stealth

26

Initial Access

26

Execution

26

Persistence

25

Command & Control

23

Privilege Escalation

23

Resource Development

21

Discovery

20

Credential Access

19

Collection

19

Most Used Toolsets

Frequency of use across Russia groups

Mimikatz

11

PsExec

11

Net

7

Cobalt Strike

6

Impacket

5

Empire

5

certutil

4

SDelete

4

🇷🇺 Russia Groups

Black Banshee, Velvet Chollima, Emerald Sleet

130 techniques 19 software

IRON TWILIGHT, SNAKEMACKEREL, Swallowtail

93 techniques 29 software

TA416, RedDelta, BRONZE PRESIDENT

85 techniques 23 software

ELECTRUM, Telebots, IRON VIKING

79 techniques 27 software

Gamaredon Group

IRON TILDEN, Primitive Bear, ACTINIUM

70 techniques 6 software

IRON HUNTER, Group 88, Waterbug

68 techniques 30 software

IRON RITUAL, IRON HEMLOCK, NobleBaron

66 techniques 49 software

UNC1878, TEMP.MixMaster, Grim Spider

64 techniques 22 software

TEMP.Isotope, DYMALLOY, Berserk Bear

56 techniques 10 software

UNC2589, Bleeding Bear, DEV-0586

47 techniques 11 software

41 techniques 0 software

Evil Corp, Manatee Tempest, DEV-0243

33 techniques 8 software

Granite Typhoon

31 techniques 16 software

InkySquid, ScarCruft, Reaper

29 techniques 13 software

28 techniques 3 software

28 techniques 3 software

TA473, UAC-0114

27 techniques 0 software

Inception Framework, Cloud Atlas

22 techniques 3 software

SEABORGIUM, Callisto Group, TA446

20 techniques 1 software

Storm-0587, TA471, UAC-0056

18 techniques 2 software

16 techniques 4 software

11 techniques 6 software

APT-C-43, El Machete

11 techniques 1 software

Nomadic Octopus

7 techniques 1 software

7 techniques 1 software

5 techniques 4 software

3 techniques 1 software

3 techniques 2 software

0 techniques 2 software

↑