GINC-APT-0951 · State

Solntsepek

Category
State · Attributed to a state or working for one.
Origin
Russia(high confidence)
Agency named
GRU
Sources
3 sources carry it
Identifier
GINC-APT-0951 · solntsepek

What it is

Solntsepek is a threat actor group with ties to the Russian military unit GRU. They have claimed responsibility for a cyberattack on Kyivstar, a Ukrainian mobile operator, and have been linked to previous attacks on Ukrainian infrastructure. Solntsepek has been associated with the Sandworm hacking group, known for their destructive cyberattacks, including the NotPetya worm. They have also engaged in hostile activities, such as revealing personal details of Ukrainian soldiers.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Tools

The tools and malware families the sources tie to it.

  • Cyber Eye RAT
  • CyberGate
  • Hacking Team UEFI Rootkit
  • MobileOrder

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de