- Category
- State · Attributed to a state or working for one.
- Origin
- Russia(high confidence)
- Agency named
- GRU
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0951 · solntsepek
What it is
Solntsepek is a threat actor group with ties to the Russian military unit GRU. They have claimed responsibility for a cyberattack on Kyivstar, a Ukrainian mobile operator, and have been linked to previous attacks on Ukrainian infrastructure. Solntsepek has been associated with the Sandworm hacking group, known for their destructive cyberattacks, including the NotPetya worm. They have also engaged in hostile activities, such as revealing personal details of Ukrainian soldiers.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- Hacking Team UEFI Rootkit
- MobileOrder
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de