DEV-0586

Threat actorRUSabotage0 reports from 0 vendors

MSTIC has not found any notable associations between this observed activity, tracked as DEV-0586, and other known activity groups. MSTIC assesses that the malware (WhisperGate), which is designed to look like ransomware but lacking a ransom recovery mechanism, is intended to be destructive and designed to render targeted devices inoperable rather than to obtain a ransom.

Vendor aliases (2)

The same group is tracked under different names by different vendors.

Vendor	Name
OSINT	Ruinous Ursa
OSINT	Cadet Blizzard

Targeting

Victim countries: Ukraine

MITRE ATT&CK techniques (0)

No techniques mapped yet.

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names DEV-0586, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to DEV-0586. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (5)

Open-source reports about this actor collected from MISP Galaxy.

microsoft.comhttps://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
msrc-blog.microsoft.comhttps://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/atoms/ruinousursa/
microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/
microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/