Loading threat actor…
InvisiMole is a stealth-focused cyber-espionage threat actor publicly identified in 2018 and also tracked as Storm-0593. The group has been observed operating against targets in Ukraine and has been linked to selective follow-on intrusions on systems previously compromised and fingerprinted by Gamaredon, indicating access-sharing or operational collaboration between Russia-aligned actors. InvisiMole is associated with long-term covert access, modular tooling, and advanced Windows tradecraft oriented toward intelligence collection and persistence. The actor’s capabilities include data theft, staging, and covert module delivery. InvisiMole has compressed stolen data with WinRAR prior to exfiltration and has used TCP-based communications to retrieve additional modules. Its tooling has employed Windows services for payload execution and has used process injection techniques, including ListPlanting, to run malicious code inside legitimate processes. The group has also used masquerading, including disguising droppers as legitimate software or documents and naming malicious components to blend into the operating system. InvisiMole has demonstrated notable kernel-level and defense-evasion sophistication. It has used Bring Your Own Vulnerable Driver techniques, including exploitation of CVE-2007-5633 in a signed vulnerable driver, to load unsigned malicious drivers. A newer variant was reported exploiting model-specific register abuse on Windows 10 x64 and attempting to bypass SMEP and SMAP protections. InvisiMole has also installed legitimate but vulnerable software components to exploit local vulnerabilities for code execution. Its kernel payloads have included functionality intended to interfere with security tooling and system monitoring. Additional anti-recovery behavior has included removing system restore points. Overall, InvisiMole is characterized by espionage-motivated post-compromise operations, strong defense evasion, persistence, covert execution, and exfiltration-focused tooling. Known aliases include Storm-0593.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat actor previously observed collaborating with Gamaredon.
Referenced in relation to infrastructure/arsenal overlap discussion involving Gamaredon, but not the primary subject of this content.
Mentioned as another actor that has historically received shared access from Gamaredon (no additional operational details provided in this content).
Actor previously observed using Gamaredon infrastructure (2020), indicating operational overlap or infrastructure sharing among Russian-aligned actors.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.