InvisiMole

InvisiMole is a cyber espionage group, active since at least October 2013, that targets high-profile organizations primarily in Eastern Europe, Russia, and Ukraine, focusing on military and diplomatic entities for long-term surveillance operations. Assessed with high confidence to be linked to Russian state-sponsored activity, the group distinguishes itself through the use of sophisticated custom malware with extensive spying capabilities, multi-stage malware payloads, and living-off-the-land techniques to achieve stealth and persistence. InvisiMole often cooperates with the Gamaredon group, leveraging Gamaredon's initial network infiltration to deploy its more advanced toolset. The group has been tracked by CERT-UA as UAC-0035.