IRIDIUM
Attribution profile
- Type
- Nation State
- Location
- Russia
- Known incidents
- 6 incidents
- Sources
- 0 sources
- First seen
- 2022-01-14
- Last seen
- 2022-10-11
- Updated
- 2026-10-04 00:26
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
IRIDIUM, also known by the alias IRIDIUM, is a threat actor linked to Russia. Microsoft has attributed the group to a ransomware campaign deploying the Prestige malware that targeted Ukraine’s transportation and logistics sectors, with spillover effects in Poland, focusing on critical supply chain infrastructure. The attacks involved rapid disk encryption of VMware ESXi servers and tailored tactics for swift network-wide encryption, indicating a deliberate disruption objective rather than financial gain. No other specific malware families, initial access vectors, or tooling details are referenced in the provided material. The actor’s known location is Russia, and its activities have been publicly tied to the Prestige ransomware operation in October 2022.
Incidents
Attributed incidents are available to members.
6 incidentsSources
Sources available to members: 0 sources.