Russia Cyber Espionage

Russia Cyber Espionage Knowledge Cell

Executive Summary

Russia maintains one of the most capable and aggressive state-sponsored cyber operations programs globally, distributed across three primary intelligence services: the GRU (military intelligence), SVR (foreign intelligence), and FSB (federal security service). Each agency operates distinct threat groups with different mandates, tradecraft, and targeting priorities. GRU units are responsible for the most disruptive and destructive operations, including election interference, critical infrastructure attacks, and wiper malware campaigns. The SVR conducts sophisticated, long-term espionage operations exemplified by the SolarWinds supply chain compromise. The FSB focuses on domestic surveillance and regional operations, particularly targeting Ukraine and former Soviet states.

The Russia-Ukraine conflict that escalated in February 2022 dramatically reshaped Russian cyber operations. The conflict saw an unprecedented volume of wiper malware variants (WhisperGate, HermeticWiper, CaddyWiper, IsaacWiper, AcidRain, and others) deployed against Ukrainian targets, alongside persistent espionage campaigns targeting NATO member states, defense contractors, and humanitarian organizations. Sandworm (GRU Unit 74455) emerged as the most prolific operator in the conflict, conducting both destructive attacks and espionage operations. The tempo of operations revealed both the breadth of Russia's offensive capabilities and the limits of cyber operations as a standalone tool of coercion.

Beyond the Ukraine theater, Russian cyber actors continue to target Western governments, defense organizations, think tanks, political entities, and critical infrastructure. APT29's operations against cloud environments and identity providers represent a sophisticated evolution in targeting, while APT28 continues aggressive credential harvesting and exploitation campaigns against government and political targets across NATO nations. Gamaredon maintains high-volume but lower-sophistication operations focused almost exclusively on Ukrainian government entities, serving as a persistent harassment and intelligence collection tool for the FSB.

Key Actors

Active Campaigns

APT29 Cloud and Identity Infrastructure Targeting (2023-Present)

APT29 has systematically pivoted to targeting cloud environments, identity providers, and authentication infrastructure following the broad migration of government and enterprise workloads to cloud platforms. The group compromised Microsoft's corporate environment in late 2023 via a password spray attack on a legacy test tenant lacking MFA, then leveraged that access to exfiltrate email from senior Microsoft executives and access source code repositories. The campaign extended to other technology companies and U.S. government agencies using Microsoft 365. APT29 demonstrates particular expertise in abusing OAuth applications, service principals, and federated identity trusts. They exploit misconfigurations in Azure AD/Entra ID, manipulate SAML tokens, and leverage compromised identity providers for downstream access to multiple victim organizations.

Sandworm Ukraine Conflict Operations (2022-Present)

Sandworm continues as the primary Russian cyber warfare operator in the Ukraine conflict, conducting a sustained campaign combining destructive attacks with intelligence collection. The group deployed multiple wiper malware families against Ukrainian government, energy, telecommunications, and financial sector targets. Notable operations include the April 2022 Industroyer2 attack targeting Ukrainian electrical substations (building on the precedent of the 2016 Industroyer/CrashOverride attack) and the AcidRain attack that disabled Viasat KA-SAT modems at the outset of the invasion. In 2023-2025, Sandworm increasingly combined destructive operations with espionage, using access to compromised networks for intelligence gathering before deploying wipers. The group has also expanded use of LOTL techniques and commodity tooling to supplement custom capabilities.

Star Blizzard Credential Harvesting Campaigns (2023-Present)

Star Blizzard (formerly Callisto/ColdRiver) conducts persistent spear-phishing campaigns targeting current and former intelligence officials, government employees, think tank researchers, journalists, and NGO staff in the U.S. and U.K. The group creates elaborate social engineering pretexts, often impersonating known contacts or colleagues. Targets receive emails containing links to adversary-controlled credential harvesting pages mimicking legitimate email providers. Compromised accounts are used for intelligence collection, and in some cases stolen documents have been selectively leaked for influence operations. The DOJ and Microsoft jointly seized over 100 domains used by the group in October 2024.

Historical Campaigns

SolarWinds Supply Chain Compromise (2020-2021)

APT29 executed one of the most sophisticated supply chain attacks in history by compromising the build system of SolarWinds Orion, a widely deployed network management platform. The trojanized SUNBURST backdoor was distributed via legitimate software updates to approximately 18,000 organizations, with the SVR selectively exploiting access in approximately 100 high-value targets including U.S. Treasury, Commerce, State Department, DHS, and major technology firms. The operation demonstrated exceptional operational security, including dormancy periods, traffic blending with legitimate Orion communications, and anti-analysis checks. Post-compromise activity used TEARDROP and Raindrop loaders to deploy Cobalt Strike beacons.

NotPetya (2017)

Sandworm deployed the NotPetya destructive malware via a compromised update to M.E.Doc, a Ukrainian tax accounting software. While disguised as ransomware, NotPetya was a wiper designed to cause maximum disruption. The malware spread laterally using EternalBlue and Mimikatz-based credential harvesting, escaping Ukraine's borders to cause an estimated $10+ billion in global damages. Maersk, Merck, FedEx/TNT Express, and Mondelez were among the most severely impacted. NotPetya remains the most destructive cyberattack in history and led to U.S., U.K., and EU attribution statements identifying the GRU.

Ukraine Power Grid Attacks (2015-2016)

Sandworm conducted two pioneering attacks against Ukraine's power grid. The December 2015 attack on Kyivoblenergo and two other distribution companies used BlackEnergy malware for initial access and the KillDisk wiper, causing power outages for approximately 225,000 customers. The December 2016 attack deployed Industroyer/CrashOverride, the first known malware specifically designed to attack electrical grid control systems (ICS/SCADA), targeting the Pivnichna substation in Kyiv. These attacks demonstrated the real-world potential of cyber operations to disrupt critical infrastructure.

TTP Evolution

Russian cyber operations have evolved significantly across several dimensions:

• Wiper Proliferation: The Ukraine conflict produced at least 10 distinct wiper malware families in 2022 alone, reflecting a strategic decision to develop disposable destructive tools rather than reuse detectable capabilities.
• Cloud Pivot: APT29 in particular has shifted focus from on-premises network exploitation to cloud identity abuse, OAuth manipulation, and attacks on federated authentication infrastructure.
• Credential Harvesting at Scale: Both APT28 and Star Blizzard rely heavily on credential phishing targeting webmail and cloud services, reflecting the value of email access for intelligence collection.
• LOTL Adoption: Russian groups increasingly use built-in OS tools, living-off-the-land binaries (LOLBins), and legitimate remote administration tools, particularly in the Ukraine theater.
• Speed and Recklessness: GRU operations in particular prioritize speed and impact over stealth, accepting the risk of detection and attribution in exchange for operational tempo.
• Hack-and-Leak Operations: Integration of cyber operations with information warfare, using stolen data for strategic leaks (e.g., DNC 2016, Star Blizzard operations).
• Satellite and Communications Targeting: AcidRain demonstrated willingness to target space-based communications infrastructure.
• Ransomware Ecosystem Ties: Circumstantial links between Russian intelligence services and ransomware groups, with some groups showing apparent tolerance from or tasking by state actors.

Infrastructure Patterns

• Extensive use of compromised legitimate websites for C2 and watering hole attacks
• Tor network for operator anonymity and C2 communications
• Bulletproof hosting providers in jurisdictions with limited cooperation agreements
• Domain typosquatting and homoglyph domains for credential harvesting
• Compromised email accounts for spear-phishing delivery
• VPN services and residential proxy networks to geolocate traffic near targets
• PowerShell Empire, Cobalt Strike, and Sliver for post-exploitation
• Encrypted communication channels using custom protocols over HTTPS
• Infrastructure shared across operations with periodic rotation

Tooling

Intelligence Gaps

• GRU-ransomware nexus: The precise relationship between Russian intelligence services and ransomware groups (safe harbor, tacit approval, active direction, or recruitment) remains poorly defined.
• Pre-positioned access in Western infrastructure: The extent of Russian pre-positioning in NATO member critical infrastructure outside Ukraine is largely unknown.
• Post-Snake Turla operations: Following the FBI's disruption of the Snake network in May 2023, Turla's current primary tooling and operational posture is not well characterized publicly.
• Coordination across agencies: The degree of operational coordination or competition between GRU, SVR, and FSB cyber units, particularly in the Ukraine theater.
• Cyber reserve forces: Russia's use of patriotic hackers, cyber militias, and private military company-affiliated cyber units alongside formal intelligence operations.
• Lessons learned integration: How Russian operators have adapted their approach based on operational successes and failures in the Ukraine conflict.

Live enrichment

When CrowdStrike Falcon Intelligence credentials are configured ($CROWDSTRIKE_CLIENT_ID), pull live vendor intelligence to keep this cell current and to answer specific actor questions:

• Actor profile — /lookup-crowdstrike actor "Cozy Bear" / actor "Fancy Bear" (origins, target countries/industries, motivations, capability, aliases)
• TTPs — /lookup-crowdstrike ttps "Fancy Bear" → ATT&CK technique IDs; resolve against /mitre-attack
• Latest reporting — /lookup-crowdstrike reports --actor "Voodoo Bear" --latest
• Actor population — /lookup-crowdstrike actors --origin russia to enumerate Russia-attributed adversaries CrowdStrike tracks (CrowdStrike uses the "Bear" cryptonym for Russian state-nexus actors)

Route through /threat-actor-profiling for a full structured profile. CrowdStrike report bodies are typically TLP:AMBER+ — cite report IDs internally, do not redistribute.

Sources & References

1. Microsoft Threat Intelligence: "Midnight Blizzard: Guidance for responders on nation-state attack" (January 2024)
2. CISA Advisory AA22-110A: "Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure" (April 2022)
3. Mandiant: "APT29 Targets Microsoft 365 Environments" (2024)
4. ESET Research: "Industroyer2: Sandworm's Cyberwarfare Targets Ukraine's Power Grid Again" (April 2022)
5. SentinelLabs: "AcidRain: A Modem Wiper Rains Down on Europe" (March 2022)
6. DOJ Press Release: "Justice Department Announces Court-Authorized Disruption of Snake Malware Network" (May 2023)
7. CrowdStrike 2025 Global Threat Report: Russia-nexus adversary activity analysis
8. NSA/CISA/FBI Joint Advisory: "Russian GRU Conducting Global Brute Force Campaign" (2021)

Change Log