GINC-APT-1108 · Hacktivist

Cyber Army of Russia

Also CyberArmyOfRussia, UAC-0107.

Category
Hacktivist · Political or nationalist, often disruption and leaks.
Origin
Russia(medium confidence)
Sources
2 sources carry it
Identifier
GINC-APT-1108 · cyber-army-of-russia

What it is

The Cyber Army of Russia is a threat group that appears to carry out cyber attacks in line with Russian strategic interests. The group has claimed many distributed denial of service (DDoS) attacks against a variety of targets perceived as opposed to Russian interests. More recently, it has claimed disruptive industrial software-based attacks against water utilities in the United States, France, and Poland. Researchers link the Cyber Army of Russia to APT44 / Sandworm Team, although it remains unclear what level of direct support, if any, is provided by the latter group.<sup>[Wired Cyber Army of Russia April 17 2024]</sup><sup>[Mandiant APT44 April 17 2024]</sup>

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

CERT-UA
UAC-0107
Other names
CyberArmyOfRussia

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

  • ThreatActor.info (Malpedia et al.)Russia

Tools

The tools and malware families the sources tie to it.

  • Archelaus Beta
  • Cyber Eye RAT
  • CyberGate
  • UNITEDRAKE