Loading threat actor…
TA829 is a Russia-linked threat actor associated with the RomCom malware ecosystem and tracked under aliases including Nebulous Mantis, Storm-0978, and UNC2596. The group has conducted both espionage-oriented and financially motivated operations, illustrating overlap between state-aligned intrusion activity and cybercrime. TA829 has been linked to campaigns active since at least 2022 and is known for using RomCom RAT as an initial foothold and remote-control backdoor, as well as related tooling including MeltingClaw, RustyClaw, DustyHammock, ShadyHammock, and SingleCamper. TA829 has targeted organizations in Ukraine and Poland, with activity initially focused on entities affected by the Russia-Ukraine conflict before later adaptation to financially motivated operations. Reported tradecraft includes phishing, compromised or spoofed software-download lures, and exploitation of Mozilla Firefox and Microsoft Windows vulnerabilities for initial access. After compromise, the actor deploys loaders and downloaders to deepen access, establish persistence, and deliver additional payloads. DustyHammock and related backdoors have been used for reconnaissance, arbitrary command execution, file delivery, long-term access, and data exfiltration. The actor demonstrates mature post-compromise tradecraft and defense evasion. Reported operational patterns include use of proxy infrastructure, SSH tunneling with PLINK, and hosting utilities through IPFS services. TA829 has also shown tactical overlap with the cluster tracked as UNK_GreenSec, including similar infrastructure and phishing tradecraft. Researchers have assessed that the two may share a third-party infrastructure provider or potentially represent the same broader operation. TA829 is widely characterized as a Russian-aligned actor whose operations span intelligence collection, sabotage-related activity in the context of Ukraine, and financially motivated intrusion activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cluster associated with RomCom RAT activity; shares tactics/infrastructure similarities with UNK_GreenSec-linked TransferLoader campaigns.
Associated in this content with RomCom campaigns; discussed as one of two distinct but apparently similar threat actors whose campaign infrastructure showed overlaps.
Russian-linked threat actor using RomCom RAT and related tooling for intelligence gathering and financial fraud, primarily against Ukrainian and Polish targets.
Russia-aligned intrusion set associated with RomCom RAT; conducts espionage and financially motivated activity, leveraging phishing and router-based proxy infrastructure, and has a history of exploiting Firefox/Windows zero-days. Uses SlipScreen in the described activity.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.