- Category
- Hacktivist · Political or nationalist, often disruption and leaks.
- Origin
- Russia(medium confidence)
- Sources
- 2 sources carry it
- Identifier
- GINC-APT-1108 · cyber-army-of-russia
What it is
The Cyber Army of Russia is a threat group that appears to carry out cyber attacks in line with Russian strategic interests. The group has claimed many distributed denial of service (DDoS) attacks against a variety of targets perceived as opposed to Russian interests. More recently, it has claimed disruptive industrial software-based attacks against water utilities in the United States, France, and Poland. Researchers link the Cyber Army of Russia to APT44 / Sandworm Team, although it remains unclear what level of direct support, if any, is provided by the latter group.<sup>[Wired Cyber Army of Russia April 17 2024]</sup><sup>[Mandiant APT44 April 17 2024]</sup>
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CERT-UA
- UAC-0107
- Other names
- CyberArmyOfRussia
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ThreatActor.info (Malpedia et al.)Russia
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- Cyber Eye RAT
- CyberGate
- UNITEDRAKE