ACTINIUM

Threat Actor Profile Updated 3 months ago
Download STIX
Preview STIX
Actinium, also known as Primitive Bear or Shuckworm, is a notable threat actor in the realm of cyber espionage, primarily focusing on Ukraine. This group is one of several Russian government Advanced Persistent Threat (APT) hacking teams that have actively engaged in cyber operations against Ukraine. The Federal Security Service unit called Gamaredon, aka Actinium, launched a significant number of attacks in the second half of 2022. Other units involved include the GRU military intelligence unit APT28, aka Strontium and Fancy Bear; SVR units APT29, aka Nobelium and Cozy Bear; and UAC-0035, aka InvisiMole, which focuses on cyberespionage. In a recent development, Microsoft, which previously used an all-caps naming scheme linked to chemical elements like ACTINIUM and IRIDIUM to describe nation-state and other advanced malware tracking activity, has changed its naming convention for threat groups. Citing the complexity, scale, and volume of threats, Microsoft has moved away from names derived from atomic elements and adopted a two-name scheme based on storm terminology. For instance, the Russia-related group formerly known as ACTINIUM is now referred to as Aqua Blizzard. This shift in nomenclature does not diminish the importance of understanding and countering these threat actors. Their activities continue to pose significant risks to cybersecurity and national security. It's crucial for organizations and entities to remain vigilant and proactive in their defense strategies, ensuring they are equipped to identify, mitigate, and respond to these ever-evolving threats.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Gamaredon
2
Gamaredon, a Russian Advanced Persistent Threat (APT) group, has been actively tracked since 2013 and is recognized as a significant threat actor in the cybersecurity landscape. Its primary target is Ukraine, against which it deploys an array of home-brewed malware through malicious documents. The E
Aqua Blizzard
1
Aqua Blizzard, previously known as ACTINIUM, is a significant threat actor originating from Russia. Recently, Microsoft revamped its naming convention for threat groups, transitioning from all-cap names based on atomic elements to a two-name scheme inspired by storm terminology. Aqua Blizzard has be
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Microsoft
Malware
Apt
Ukraine
Russia
russian
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
InvisiMoleUnspecified
1
InvisiMole is a sophisticated malware with modular architecture, designed to infiltrate and exploit computer systems undetected. It begins its operation using a wrapper DLL and performs activities through two other modules embedded in its resources. Notably, the malware is capable of scanning enable
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
STRONTIUMUnspecified
1
Strontium, also known as APT28, Fancy Bear, Forest Blizzard, and several other aliases, is a Russia-linked threat actor that has been active since at least 2007. This group, believed to be associated with the Russian General Staff Main Intelligence Directorate (GRU), has targeted governments, milita
NOBELIUMUnspecified
1
Nobelium, a threat actor linked to Russia's SVR, has been actively targeting French diplomatic entities as part of its cyber-espionage activities. The Advanced Persistent Threat (APT) group has utilized sophisticated techniques such as phishing and attempts to install Cobalt Strike, an advanced malw
APT28Unspecified
1
APT28, also known as Fancy Bear, is a threat actor linked to Russia and has been involved in numerous cyber espionage campaigns. The group is notorious for its sophisticated tactics, techniques, and procedures (TTPs). Recently, NATO and the EU formally condemned APT28's activities, acknowledging the
Fancy BearUnspecified
1
Fancy Bear is a sophisticated Russian-based threat actor, also known as Sofacy or APT 28, that has been active since the mid-2000s. Fancy Bear is responsible for targeted intrusion campaigns against the Aerospace, Defense, Energy, Government and Media sectors. At the DNC, both Cozy Bear and Fancy Be
APT29Unspecified
1
APT29, also known as Cozy Bear, SVR group, BlueBravo, Nobelium, Midnight Blizzard, and The Dukes, is a threat actor linked to Russia. This group is notorious for its malicious activities in the cybersecurity realm, executing actions with harmful intent. It has been associated with several high-profi
Cozy BearUnspecified
1
Cozy Bear, also known as APT29, is a threat actor linked to the Russian government that has been implicated in numerous cyber-espionage activities. The group's activities have been traced back to at least 2015, when they were identified as infiltrating the Democratic National Committee (DNC) network
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the ACTINIUM Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
8 months ago
Russian Hackers Have New Tools
CERT-EU
10 months ago
Slone Partners Places Cynthia Pussinen as Chief Executive Officer and Member of the Board of Directors at Sernova Corporation
CERT-EU
a year ago
Warnung vor russischem Bedrohungsakteur Gamaredon : Wie man sich vor der Cyber-Bedrohung schützen kann – Global Security Mag Online
BankInfoSecurity
a year ago
Ukraine Tracks Increased Russian Focus on Cyberespionage
CERT-EU
a year ago
Microsoft Will Name Threat Actors After Weather Events
DARKReading
a year ago
Threat Actor Names Proliferate, Adding Confusion