GINC-APT-0415 · Targeted, sponsor unknown

Lexus

Also TA499, Vovan, Vovan and Lexus.

Category
Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
Origin
Russia(medium confidence)
Seen
2023
Status
Dormant
Sources
5 sources carry it
Identifier
GINC-APT-0415 · lexus

What it is

TA499, also known as Vovan and Lexus, is a Russia-aligned threat actor that has aggressively engaged in email campaigns since at least 2021. The threat actor’s campaigns attempt to convince high-profile North American and European government officials as well as CEOs of prominent companies and celebrities into participating in recorded phone calls or video chats.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Proofpoint
TA499
Other names
Vovan, Vovan and Lexus

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de