Cyber Threat Actor: Russian Government

The threat actor is known by the aliases Russian Government, Kremlin and Russian Federation and is based in Russia. Public reporting links the actor to a range of operations that target government institutions, critical infrastructure and technology firms across Europe and North America. Observed objectives include espionage, as seen in the compromise of the U.S. Department of Justice Office 365 environment and the theft of Red Team tools from a cybersecurity company, and disruption, exemplified by distributed denial‑of‑service attacks on a Polish tax website and the Viasat KA‑SAT satellite communications outage that affected users in multiple European countries. The actor’s tactics frequently involve phishing emails with malicious attachments to deliver information‑stealing malware, the use of supply‑chain compromises such as the SolarWinds update mechanism to gain persistent access, and the deployment of destructive malware disguised as ransomware that wipes systems. In several incidents the actor has leveraged publicly leaked NSA‑derived exploits, similar to those used in the NotPetya outbreak, to achieve rapid propagation. Attribution to Russian state entities is repeatedly cited, with specific references to the FSB intelligence agency in the dismantling of a cyber‑espionage network operating through Russian nationals in the Czech Republic. The actor’s activities are therefore characterized by a blend of espionage‑focused intrusions, disruptive attacks on infrastructure and the use of both covert supply‑chain methods and overt denial‑of‑service techniques.

Notable campaigns attributed to the actor include the 2020 SolarWinds intrusion that provided unauthorized access to email accounts within the U.S. Department of Justice, the 2020 breach of a leading cybersecurity firm where proprietary Red Team tools were exfiltrated, and the 2022 destructive malware operation against Ukrainian government agencies that was identified by Microsoft as wiper‑style code. Additional highlighted actions are the February 2022 DDoS against Poland’s online tax filing service, which disrupted public access without compromising data, and the February 2022 cyberattack on the Viasat KA‑SAT satellite system that knocked out broadband services for thousands of users across Europe. Earlier operations feature a 2018 phishing campaign targeting Ukraine’s judiciary telecommunications networks and the 2018 dismantling by Czech authorities of an alleged Russian cyber‑espionage network linked to the FSB and funded through the Russian embassy in Prague. While some incidents such as the 2017 NotPetya outbreak show overlapping impact on Russian entities, the publicly reported cases above demonstrate a consistent pattern of state‑aligned activity focused on intelligence gathering, service disruption and the theft of security‑testing tools.