InvisiMole

InvisiMole is a cyber espionage group that first emerged in at least 2013, with early versions of its malware having a PE timestamp of October 13, 2013. The group is assessed with moderate confidence to be of Russian origin, given its strong connections to the Russia-linked Gamaredon threat group and its targeting of entities in both Ukraine and Russia. Its primary motivation is cyber espionage, focusing on long-term surveillance operations against high-profile targets. What distinguishes InvisiMole is its use of highly potent, custom spyware designed for extensive data exfiltration and covert operation, often deployed in very limited, targeted campaigns with a low infection ratio. The group frequently cooperates with Gamaredon, where InvisiMole's more advanced tools are reserved for particularly significant targets already compromised by Gamaredon. InvisiMole's malware components often feature per-victim encryption to hinder detection and analysis.