Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
espionage
RussiaThreat Actor
Active Threat
Gamaredon
3.1k
IOCs Tracked
123
Intel Reports
Associated IOCs50 total
MD547
a12f94a1e77bc925aa9557915d3052792026-10-06High
f9157fc7b6c98ecbc6564a643c89a2f02026-10-06High
f9924554fa3a3b3e1cce40c3aaf5f0c82026-10-06High
ff33739d20401e9431abe56b4644ed152026-10-06High
20c6a451d66d0c88f41983ba39cfea1c2026-10-06High
879c31b3ba6858c6dd9abf9ce293e6752026-10-06High
d6ebcee81c0755d8c08a271f5163d8f42026-10-06High
fcb7f71910a9d85d346f3e2ac1dba73c2026-10-05High
ce3da8a6a5a6b91407266eb7290337412026-10-05High
3636f3456e254805bb47d2c8ce7db9af2026-10-05High
5e0ceef3d6904ad17f7782995c60b5922026-10-05High
892cb07e1cd390ce0856a9c0ba6a7e302026-10-05High
876066bff1843f1b333f2c7600e82a762026-10-05High
3535416c053c702f6fa852d86719f5902026-10-05High
2fc855097cfa7703693942bd95230a9a2026-10-06High
bc71c7d9e8348c5ac9c3e009730d73932026-10-05High
f28becd1e85a7909235e93d8e50094952026-10-05High
2857cb575fbe73e6d7b0dd9b06db18ec2026-10-05High
951b720e4973ed37fbe8ef21c82cb4ee2026-10-06High
5135b99ddfb605c52574cb0a0df570742026-10-06High
4cbb63145a191200736bff102dfd2af02026-10-05High
c3fb12e5e1134c79e526754913ae55dd2026-10-05High
f3e9b5c858be3a154e05cfa38af963d42026-10-05High
6e6ef4b53663b00a035e19cfcc3c4fc52026-10-05High
2ce09e6c66abefdaed903f3add8e9fbb2026-10-05High
c4b0b9c6919a8f775dfd16dcd6cb75822026-10-06High
8461b08b34ee30662eebe47cd5e957e62026-10-05High
44ef4338d426cecca8a92bed43cd255c2026-10-06High
0740fcabd6bbb48f453c644dfe68a2762026-10-05High
7ab97710edf77e78c50fa437fe98a7472026-10-05High
4b171153bf0a462c7eb4643ad6386af62026-10-05High
ac4853679479143ee43a4d9a295c70f42026-10-06High
8d7a3b6c4213589ee2c56dba3303fc6c2026-10-05High
6425401e44e5a35a78b36215e98b0f742026-10-05High
5068862df0d5484d2f806c82aea8aea82026-10-05High
30f5e0b936264db91a7dd30be35fa6592026-10-05High
5e8b5d284c6cbfb0911ace50b043d2602026-10-06High
9b755452be7f3003ba387a789d84094f2026-10-06High
a6716e60895e3dc8f82f9ce3bcf732612026-10-06High
fd20ce94a02db80f79eee993467c0e962026-10-05High
32a0faa41ca82d8b64295e5e71d29e622026-10-05High
08063d820abed9d194d00c2944e80d8b2026-10-05High
03b676afc16012a44950dd26ce34d5fd2026-10-05High
cdf46fff1368fb017ceff13a84854eec2026-10-05High
b9706d5702ac1f4b890e50675f9ad5232026-10-05High
a2d8348b82d88f2f7a24a17f6cbadbd12026-10-05High
c2ad2c529a1d0fcdba79780be1743fef2026-10-05High
SHA2563
c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e1b39f9b2b96a6586c4a11ab2fdbff8fdf16ba5a0ac7603149023d73f33b84498284e5ec8748f99fd1b8c331b699a5fe5fd4448bbaae0347a940f427f931c4d142026-10-16High
Related Reports123 total
Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain
PolySwarmOct 19, 2026
Chinese State-Linked Hackers Target US Critical Infrastructure with Automated Scanning and Cyber Espionage Tools
PolySwarmOct 16, 2026
ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure
PolySwarmOct 13, 2026
China Linked Warlock Ransomware Campaign Targets Critical Infrastructure
PolySwarmOct 9, 2026
Targeting the Systems Behind the Mission: OT Threats to US Critical Infrastructure and Military Operations
PolySwarmOct 5, 2026
BlueMoon Exploit Kit Rapidly Targets Key Verticals Across Multiple Espionage Campaigns
PolySwarmSep 21, 2026
FamousSparrow Takes Flight with New SparroWocky Backdoor
PolySwarmSep 25, 2026
BraZetsu: AI-Enhanced Reconnaissance Fuels Exilware’s Access Marketplace
PolySwarmSep 11, 2026
The Job Offer Has Claws: Mirage Kitten Deploys NodeRabbit and PollCat
PolySwarmSep 8, 2026
Gamers Get Played: Fake GTA6 Leaks Deliver a Grab Bag of Malware
PolySwarmSep 14, 2026
China and the Cyber Arms Race for AI Supremacy
PolySwarmSep 21, 2026
CLOSEDQUORUM: Malware Puts AI in the C2 Loop
PolySwarmSep 28, 2026
Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer
PolySwarmOct 2, 2026
Abuse.ch MalwareBazaar (1000 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1032 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1063 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1083 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1077 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1091 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1098 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1096 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1065 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1057 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1059 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1063 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1069 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1065 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1013 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1019 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1017 samples)
Abuse.ch MalwareBazaar
Threat Profile
Motivationespionage
Origin
Russia
Last seenOct 2026
IOCs tracked3,055