IRON VIKING

Iron Viking, a threat actor group also known as Sandworm, Telebots, Voodoo Bear, and other names, has been active since 2000. This group operates under the control of Unit 74455 of the Russian GRU’s Main Center for Special Technologies (GTsST). Iron Viking is notorious for its destructive cyber-espionage campaigns, using tools such as NotPetya for their disruptive capabilities. The group was first uncovered by Ukraine's security agency, the SBU, which attributed a recent attack to Iron Viking. The group's activities have evolved over time, with different facets of its operations being observed by various cybersecurity companies, leading to the multitude of names associated with it. For instance, the group has been linked to BlackEnergy, UAC-0082, and others, each name reflecting a different aspect of the group's activities. Despite the varying nomenclature, the constant factor remains the group's malicious intent and its affiliation with the Russian GRU. The group's actions pose significant threats to global cybersecurity, demonstrating advanced capabilities and a clear willingness to deploy destructive attacks. Understanding the operations of Iron Viking and similar groups is crucial for developing effective cybersecurity strategies and defenses.