BROMINE
Attribution profile
- Type
- Nation State
- Location
- Russia
- Known incidents
- 3 incidents
- Sources
- 0 sources
- First seen
- 2022-01-14
- Last seen
- 2022-03-16
- Updated
- 2026-10-04 00:41
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
BROMINE is a Russia‑based threat actor linked to Russian APT groups. It has conducted influence operations and destructive cyber attacks against Ukrainian government, energy, IT, and media sectors, aiming to disrupt services, spread disinformation, and undermine public trust. Its tactics include distributing deepfake videos via compromised news sites and social media, deploying wiper malware such as WhisperGate, FoxBlade, HermeticWiper, and Industroyer2, and conducting spear‑phishing campaigns against military personnel. These activities have been coordinated with kinetic military actions during the 2022 conflict, exemplified by the March 2022 deepfake‑wiper campaign and the January 2022 destructive malware attacks on Ukrainian agencies.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 0 sources.