Loading threat actor…
TEMP.Armageddon, also known as CARPATHIAN and UNC530, is a Russian-linked cyber espionage threat actor assessed to operate from occupied Crimea and eastern Ukraine. The group has been associated with Kremlin-aligned operations and has focused heavily on Ukrainian targets, particularly during the broader Russia-Ukraine conflict. Its activity is consistent with intelligence collection and access operations against military, government, and related strategic organizations. The actor is known for using removable-media and USB-driven intrusion chains, including malware families such as QUICKGAME, to gain and extend access in victim environments. It has also exploited WinRAR vulnerability CVE-2025-8088 in campaigns against Ukrainian entities, using crafted RAR archives to place HTA downloader payloads into Windows Startup folders for persistence and follow-on malware delivery. Reported activity involving this technique continued into 2026. Observed tradecraft includes initial access through malicious archives and removable media, persistence via Startup-folder abuse, downloader-based staging of second-stage payloads, and broader post-compromise access enablement. TEMP.Armageddon has been identified among several Russian-nexus espionage actors targeting Ukrainian military, government, and technology-related organizations. Its operations are best characterized as state-aligned espionage rather than financially motivated crime.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Exploits CVE-2025-8088 via RAR archives to plant HTA downloaders in Windows Startup for persistence and second-stage payload delivery; activity observed through Jan 2026.
Kremlin-linked activity exploiting CVE-2025-8088 to target Ukrainian military/government/technology sectors.
Russian-nexus espionage activity exploiting/attempting to exploit CVE-2025-8088 against Ukrainian targets.
Exploiting CVE-2025-8088 to drop HTA downloaders into Windows Startup folders for persistence and subsequent payload retrieval; activity ongoing into 2026.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.