- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G1000 · 4 techniques
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0267 · allanite
What it is
ALLANITE is a suspected Russian cyber espionage group, that has primarily targeted the electric utility sector within the United States and United Kingdom. The group's tactics and techniques are reportedly similar to Dragonfly, although ALLANITEs technical capabilities have not exhibited disruptive or destructive abilities. It has been suggested that the group maintains a presence in ICS for the purpose of gaining understanding of processes and to maintain persistence.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G1000
- Other names
- Palmetto Fusion
Targets
- Countries
- United Kingdom, United States
- Sectors
- Energy
Tools
The tools and malware families the sources tie to it.
- UNITEDRAKE
- Windows Remote Desktop
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de