Loading threat actor…
Russian Business Network (RBN) is a Russian cybercrime syndicate and hosting network widely associated with spam, malware distribution, and other criminal internet infrastructure. It is commonly referred to by the abbreviation RBN. Reporting has linked infrastructure associated with the group to bulletproof-style hosting and upstream network arrangements used to support cybercrime operations while obscuring ownership and continuity. RBN has been associated with infrastructure used to host or support malware operations, including activity tied to the ZeroAccess crimeware ecosystem. In that context, network-forensics reporting linked hosting on the Ecatel network to infrastructure assessed as controlled by RBN. Separate reporting also described apparent rebranding or reassignment of network resources associated with RBN, including the use of deceptive registration details to mask continuity of the same upstream infrastructure. The actor is best characterized as a financially motivated cybercrime organization rather than a state-sponsored espionage group. Available high-confidence information in this record supports its role as an enabler and operator of malicious infrastructure used for malware delivery and broader cybercriminal services, but does not provide sufficiently specific, corroborated detail on distinct victim countries, sectors, or a fuller ATT&CK-style operational profile beyond infrastructure support for malware activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RBN appears only in a generic Wikipedia navigation list of hacking groups, without any discussion tying it to the PoisonIvy content.
Groups Anonymous associated events Avalanche Crime Boys GNAA Goatse Security Insanity Zine Corp. GhostNet Level Seven PLA Unit 61398 Prime Suspectz RBN ShadowCrew World of Hell Sandworm
Groups Anonymous associated events Avalanche Crime Boys GNAA Goatse Security Insanity Zine Corp. GhostNet Level Seven PLA Unit 61398 Prime Suspectz RBN ShadowCrew World of Hell Sandworm
Referenced as the cybercrime syndicate allegedly controlling the Ecatel Network from which ZeroAccess infrastructure was said to originate.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.