Krypton

Krypton, also known as Secret Blizzard or UAC-0003, is a significant threat actor that has been associated with Russia's Federal Security Service (FSB). This Advanced Persistent Threat (APT) group has been active since at least 2004, targeting diplomatic and government organizations as well as private businesses across the globe, including regions such as the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. Krypton leverages a novel .NET backdoor called DeliveryCheck to deliver various second-stage payloads, primarily targeting the defense sector in Ukraine and Eastern Europe. Recently, Microsoft has identified targeted attacks by Krypton against Exchange Server components, enabling this cyberespionage tool to execute illicit activities. These include executing JavaScript, extracting data from event logs, and stealing credentials from various programs such as browsers, FTP clients, VPN software, KeePass, Azure, AWS, and Outlook. The distinctive tactics, techniques, and use of KAZUAR have confidently linked this activity to the FSB-led group. In addition to its cyberespionage capabilities, the Krypton network also offers Distributed Denial-of-Service (DDoS) services for hire. It has been known to advertise these services to hacktivists wishing to target Israeli organizations. Furthermore, Krypton Networks has shown interest in releasing version 3 of its botnet service, which targets large organizations like Spotify. This botnet, known for its DDoS-for-hire capabilities, allegedly includes several features designed to bypass DDoS mitigation services.