InvisiMoleThreat actor
Adversary group targeting diplomatic missions, governmental and military organisations, mainly in Ukraine.From MISP Galaxy
Last reported yesterday, by The Hacker News6 reports
ATT&CK techniques
6 of 22 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.006HTML Smuggling
“Al igual que en años anteriores, la mayoría utilizó archivos comprimidos o archivos XHTML que empleaban HTML smuggling para entregar downloaders HTA maliciosos, los cuales a su vez descargaban el downloader en VBScript PteroSand y payloads adicionales.”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack“Furthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia.”
-
MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm“En el pasado, Gamaredon colaboró con un actor de amenazas que descubrimos y al que denominamos InvisiMole.”
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration“In the past, Gamaredon collaborated with a threat actor that we discovered and named InvisiMole.”
-
Gamaredon en 2025: uso de túneles, workers, dead drops y nuevas alianzas“En el pasado, Gamaredon también colaboró con un actor de amenazas que descubrimos y denominamos InvisiMole.”
-
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances“In the past, Gamaredon also collaborated with a threat actor that we discovered and named InvisiMole.”
-
FSB’s matryoshka #3/3: Gamaredon's Gammasteel Infostealer“Notably, this TTP strongly overlaps with the historical behaviors of the InvisiMole intrusion-set in 2020, an FSB-linked operator previously observed cooperating with Gamaredon, as detailed by ESET in their report InvisiMole: The Hidden Part of the Story.”
Indicators in its reports
named in the reports above- write[.]asin 3 reports
- lesma[.]euin 3 reports
- tebi[.]ioin 3 reports
- de-fra.i3storage[.]comin 3 reports
- devtunnels[.]msin 2 reports
- loophole[.]sitein 2 reports
- loca[.]ltin 2 reports
- bore[.]pubin 2 reports
- cleverapps[.]ioin 2 reports
- teletype[.]inin 2 reports
- nopaste[.]netin 2 reports
- pastee[.]devin 2 reports
- hxxps://uztickets[.]comin 2 reports
- uztickets[.]comin 2 reports
- hxxps://egyptanimals[.]com/animals/photoalbumin 2 reports
- egyptanimals[.]comin 2 reports
- adomd[.]netin 2 reports
- hxxp://51.15.204[.]214/in 2 reports
Copy these 18 indicators · defanged
Thanks — we review every report.