- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Russia(medium confidence)
- Seen
- 2023
- Status
- Dormant
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0415 · lexus
What it is
TA499, also known as Vovan and Lexus, is a Russia-aligned threat actor that has aggressively engaged in email campaigns since at least 2021. The threat actor’s campaigns attempt to convince high-profile North American and European government officials as well as CEOs of prominent companies and celebrities into participating in recorded phone calls or video chats.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Proofpoint
- TA499
- Other names
- Vovan, Vovan and Lexus
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de