27.02.2024
7 min
1410
Which State-Sponsored and State-Linked Hacking Groups Are Targeting Russian Organizations? We’ve compiled cybersecurity research reports, data on APT groups, their origins, targets, and documented cyber operations.
Russia remains a target of hacking groups whose activities cybersecurity researchers associate with government agencies in various countries. Their operations target government institutions, industrial enterprises, the defense sector, technology companies, and other organizations.
Technical investigations conducted by Positive Technologies, Kaspersky, BI.ZONE, Group-IB/F.A.C.C.T., and international cybersecurity teams help identify who may be behind these attacks. Based on their publicly available reports, a table has been compiled listing known hacking groups, their presumed countries of origin, targets within Russia, and links to relevant research.
The primary focus is on APT (Advanced Persistent Threat) groups. This term refers to organized threat actors with substantial technical resources who employ sophisticated intrusion techniques and can remain undetected in compromised systems for extended periods. Researchers associate the activities of many APT groups with the interests of specific countries, although such attribution does not always indicate proven direct control by government agencies.
Hacktivist groups represent a separate category of threat actors that conduct cyber operations for political or ideological reasons. Traditionally, hacktivism has been associated with public campaigns, website compromises, information leaks, and DDoS attacks.
However, some groups have expanded their activities beyond these methods. They systematically target specific organizations, conduct sophisticated operations, and remain active over extended periods, particularly during armed conflicts. The nature of their activities may resemble those of APT groups, although their organizational status and connections to government agencies remain subjects of ongoing research.
For this reason, the list includes not only traditional APT groups but also certain hacktivist groups that researchers associate with targeted cyber operations.
The table organizes information from publicly available research reports published primarily between 2021 and 2026. Selected materials from earlier years are also included.
Each group is described using the following fields:
Name: The primary designation and alternative names used by different cybersecurity companies. Additional information about naming conventions and group aliases can be found in the Malpedia database.
Country: The country that researchers associate with the group’s activities. Attribution is based on published reports or established assessments by cybersecurity specialists.
Targets in Russia: Industries and types of organizations that have been targeted. Research reports do not always disclose the specific names of affected companies.
Reports: Links to research publications describing the group’s activities, tools, and attack techniques.
Total: The number of reports associated with the activities of the respective group.
In some cases, research publications do not provide direct attribution. However, the documented activity can be linked to known groups through similarities in technical indicators identified in previous reports.
If a single operation is associated with multiple groups, the corresponding report is listed under each group and highlighted in italics. Reports containing potentially incorrect attribution, as identified through comparison with other research, are marked with an asterisk (*).
The first version of the table was published on April 2, 2024. Since then, the list has been regularly expanded with new research reports, while the attribution of certain groups has been refined.
The latest update was released on November 3, 2026. It added 68 reports, primarily covering the period from April to October 2026, along with selected older publications. As part of this update, the TA428 and TaskMasters groups were merged, and reports with potentially incorrect attribution received special markings.
Previous updates were published on October 24, 2024; April 9, 2025; October 13, 2025; and April 14, 2026.
The table covers only a portion of publicly documented cyber operations targeting Russian organizations. It excludes conventional cybercriminal groups whose activities are primarily financially motivated. Furthermore, not all state-sponsored cyber operations are covered in dedicated technical reports. For example, the list does not include the US Cyber Command operation against the Russian news agency RIA FAN in November 2018.
It is also important to recognize that cyber attribution does not always make it possible to identify an attacker with certainty. Different cybersecurity companies may assign their own names to threat groups, assess their origins differently, or attribute the same operations to different actors. Therefore, the table should be viewed as a structured overview of publicly available research rather than a definitive list of all state-sponsored hackers conducting cyberattacks against Russia.
