VORANT. Threat Intelligence Sign in Get the full feed

Experts dissect Russia's cybercriminal proxy model

routine threat government-nationalfinancial-servicesenergydefensetelecommunications

Atlantic Council experts examine how Russia uses cybercriminal groups like Conti and Evil Corp as proxies for state cyber operations amid the Ukraine invasion.

This roundtable discussion features five cyber policy experts analyzing Russia's use of non-state actors—cybercriminal groups—as instruments of state cyber statecraft. Key examples cited include Conti's public pledge of allegiance to the Kremlin following the invasion of Ukraine, Evil Corp's leader Maksim Yakubets' ties to the FSB, and TrickBot operators' apparent targeting of US election infrastructure in 2020. Experts describe a spectrum of state-criminal cooperation ranging from ad hoc tasking to deep sponsorship, noting that Russia grants criminal groups a 'long leash' as long as they avoid targeting domestic organizations, providing plausible deniability while advancing Kremlin interests abroad.

The discussion also covers Belarus-linked group UNC1151, which Ukraine attributes to Belarusian intelligence and which allegedly defaced government websites and deployed wiper malware in January 2022, later linked to spear-phishing campaigns targeting European nations aiding Ukrainian refugees. Experts differ on the degree of Belarus-Russia cyber cooperation, with some seeing alignment given Lukashenko's dependence on Russian support, and others viewing Belarusian actors as more independent.

Panelists reflect on Russian state-sponsored groups including Sandworm (GRU), APT28 (GRU), and Turla (FSB), noting Sandworm's history with BlackEnergy and the 2015 Ukrainian power grid attack, as well as the 2017 NotPetya attack attributed to Russian military intelligence. Discussion of the current war notes that expected large-scale destructive cyberattacks did not materialize alongside the invasion, with observed activity limited to DDoS attacks, defacements, and wiper malware—assessed as relatively rudimentary compared to expectations, though the NCSC's disclosure of Sandworm's Cyclops Blink tool suggests more capable tooling exists in reserve.

Mentioned in this report

Threat actors APT28BuhTrapContiIndrik SpiderSandworm TeamTurlaUNC1151
Malware BlackEnergyContiCyclops BlinkNotPetyaTrickBotVPNFilter

Detection guidance

Wiper Malware Execution with Mass File Deletion

ATT&CK T1485

Detects processes performing mass file deletion operations characteristic of wiper malware deployed in destructive campaigns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Wiper Malware Execution with Mass File Deletion
description: Detects processes performing rapid, recursive file deletion across multiple
  directories - behaviour consistent with wiper malware such as those deployed in
  destructive state-sponsored campaigns. Targets command-line patterns using del/rm
  with wildcard recursion or tools like cipher /w.
tags:
- attack.impact
- attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection_del_recursive:
    CommandLine|contains: \*
  selection_cipher_wipe:
    Image|endswith: \cipher.exe
    CommandLine|contains: /w
  selection_format_drive:
    Image|endswith:
    - \format.exe
    - \diskpart.exe
    CommandLine|contains:
    - '/fs:'
    - clean all
  filter_admin_cleanup:
    CommandLine|contains:
    - Temp\*
    - Recycle.Bin
  condition: (selection_del_recursive or selection_cipher_wipe or selection_format_drive)
    and not filter_admin_cleanup
falsepositives:
- System maintenance tools performing scheduled disk cleanup
- IT admin scripts removing temporary files during deployment
level: high
id: 6212e162-aa95-5fa4-9922-a22be84c315c
status: experimental
author: Vorant

Large-Scale Phishing Campaign with Spear-Phishing Indicators

ATT&CK T1566

Detects email client or attachment handling processes consistent with spear-phishing distribution campaigns targeting specific geographic regions or user populations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Large-Scale Phishing Campaign with Spear-Phishing Indicators
description: Detects processes associated with email clients or Office applications
  spawning child processes to open attachments, combined with suspicious network indicators
  or archive extraction - consistent with spear-phishing campaigns. Targets parent/child
  relations and archive handling characteristic of phishing campaigns distributing
  malware payloads.
tags:
- attack.initial-access
- attack.t1566
logsource:
  category: process_creation
  product: windows
detection:
  selection_email_attachment:
    ParentImage|endswith:
    - \outlook.exe
    - \thunderbird.exe
    Image|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \AcroRd32.exe
  selection_archive_extraction:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    Image|endswith:
    - \WinRAR.exe
    - \7zFM.exe
    - \explorer.exe
    CommandLine|contains:
    - .zip
    - .rar
    - .7z
  selection_suspicious_office_args:
    Image|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    CommandLine|contains: /dde
  filter_legit_extract:
    CommandLine|contains:
    - Program Files
    - Updates
  condition: (selection_email_attachment or selection_archive_extraction or selection_suspicious_office_args)
    and not filter_legit_extract
falsepositives:
- Users manually extracting email attachments via archive managers
- Legitimate software update mechanisms using DDE
level: medium
id: e6f255a0-f915-5db4-9375-2757a6aae950
status: experimental
author: Vorant

Website Defacement via Web Server Process Modification

ATT&CK T1491

Detects web server processes writing to web-accessible directories with content replacement patterns indicative of defacement attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Website Defacement via Web Server Process Modification
description: Detects web server processes (IIS, Apache, nginx) or their child processes
  writing or modifying files in web root directories - consistent with website defacement
  campaigns. Targets file write operations to common web directories combined with
  suspicious file extensions or content operations.
tags:
- attack.impact
- attack.t1491
logsource:
  category: file_event
  product: windows
detection:
  selection_iis_write:
    Image|endswith:
    - \w3wp.exe
    - \iisexpress.exe
    TargetFilename|contains:
    - \inetpub\wwwroot
    - \wwwroot
    TargetFilename|endswith:
    - .html
    - .htm
    - .asp
    - .aspx
  selection_process_write_webdir:
    ParentImage|endswith:
    - \w3wp.exe
    - \apache.exe
    - \nginx.exe
    TargetFilename|contains:
    - \wwwroot
    - \html
    - \public_html
    EventType: WriteFile
  filter_legitimate_deploy:
    TargetFilename|contains:
    - web.config
    - config.xml
    - .backup
  condition: (selection_iis_write or selection_process_write_webdir) and not filter_legitimate_deploy
falsepositives:
- Legitimate web application updates and deployments
- Content management systems writing HTML templates during normal operation
level: medium
id: ae36afd9-a682-56fe-ba5c-ac60dfd0950f
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-russias-cyber-statecraft

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free