Krypton

Threat Actor Profile Updated 11 days ago
Download STIX
Preview STIX
Krypton, also known as Secret Blizzard or UAC-0003, is a significant threat actor that has been associated with Russia's Federal Security Service (FSB). This Advanced Persistent Threat (APT) group has been active since at least 2004, targeting diplomatic and government organizations as well as private businesses across the globe, including regions such as the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations. Krypton leverages a novel .NET backdoor called DeliveryCheck to deliver various second-stage payloads, primarily targeting the defense sector in Ukraine and Eastern Europe. Recently, Microsoft has identified targeted attacks by Krypton against Exchange Server components, enabling this cyberespionage tool to execute illicit activities. These include executing JavaScript, extracting data from event logs, and stealing credentials from various programs such as browsers, FTP clients, VPN software, KeePass, Azure, AWS, and Outlook. The distinctive tactics, techniques, and use of KAZUAR have confidently linked this activity to the FSB-led group. In addition to its cyberespionage capabilities, the Krypton network also offers Distributed Denial-of-Service (DDoS) services for hire. It has been known to advertise these services to hacktivists wishing to target Israeli organizations. Furthermore, Krypton Networks has shown interest in releasing version 3 of its botnet service, which targets large organizations like Spotify. This botnet, known for its DDoS-for-hire capabilities, allegedly includes several features designed to bypass DDoS mitigation services.
What's your take? (Question 1 of 5)
7301bc75-00c5-498c-a52d-df86ea6c1dfa Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Turla
3
Turla, also known as Pensive Ursa, Snake, Uroburos, Waterbug, Venomous Bear, and KRYPTON, is a threat actor that has been active since at least 2004. This group, which is believed to be Russia-sponsored, primarily targets diplomatic and government organizations, private businesses, and non-governmen
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Apt
Ddos
Botnet
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
UroburosUnspecified
2
Uroburos, also known as Snake, Turla, Pensive Ursa, and Venomous Bear, is a sophisticated malware linked to the Russian Federal Security Service (FSB). The development of this malicious software began in late 2003, with its operations traced back to at least 2004. Uroburos is part of a broader arsen
KazuarUnspecified
2
Kazuar is a sophisticated multiplatform trojan horse malware, linked to the Russian-based threat group Turla (also known as Pensive Ursa, Uroburos, Snake), which has been operating since at least 2004. This group, believed to be connected to the Russian Federal Security Service (FSB), utilizes an ar
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
Venomous BearUnspecified
2
Venomous Bear, also known as Turla, Urobouros, Snake, and other names, is a threat actor group attributed to Center 16 of the Federal Security Service (FSB) of the Russian Federation. The group has been active since at least 2004, targeting diplomatic and government organizations, as well as private
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Krypton Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
10 months ago
Hackers Turn Exchange Servers into Malware Command & Control Centers
CERT-EU
a year ago
Russian Hackers Tomiris Targeting Central Asia for Intelligence Gathering | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker – National Cyber Security Consulting
CERT-EU
a year ago
Russian Hackers Tomiris Targeting Central Asia for Intelligence Gathering
CERT-EU
8 months ago
The Israel–Hamas Conflict: Implications for the Cyber Threat Landscape - ReliaQuest
DARKReading
8 months ago
Hackers For Hire Hit Both Sides in Israel-Hamas Conflict
CERT-EU
7 months ago
KillNet group touts new feature-rich ‘DDoS-for-hire’ service
DARKReading
a year ago
Insights Into Nation-State Tactics: Lessons From Russia's Hybrid War In Ukraine
Securityaffairs
11 days ago
Turla APT used two new backdoors to infiltrate a European ministry of foreign affairs
Securityaffairs
3 months ago
Turla APT uses new TinyTurla-NG backdoor to spy on Polish NGOs
BankInfoSecurity
10 months ago
Russian Hackers Probe Ukrainian Defense Sector With Backdoor
CERT-EU
10 months ago
Turla hackers target defense sector in Ukraine and Eastern Europe