Loading threat actor…
Mercenary Akula is a Russia-aligned threat cluster attributed to UAC-0050, also known as the DaVinci Group. The actor has been characterized as a mercenary group associated with Russian law enforcement interests and has operated under the “Fire Cells” branding. Its activity has centered on social engineering, intelligence collection, and financially motivated operations, with historical targeting focused on Ukraine and a more recent observed operation against a European financial institution involved in regional development and reconstruction. The group commonly relies on spear-phishing with themed lures tailored to the victim’s role, including legal and administrative pretexts. It has used spoofing to increase message credibility and has delivered multi-stage archive chains designed to evade reputation-based and conventional security controls. Mercenary Akula has deployed legitimate remote access software to obtain stealthy, persistent access, including Remote Manipulator System and previously LiteManager, and has also used remote access malware such as RemcosRAT. This tradecraft supports remote control, file transfer, and sustained post-compromise access while blending with legitimate software usage. Observed victimology includes accountants, financial officers, and personnel connected to procurement and policy functions, indicating an emphasis on access to sensitive financial, legal, and organizational information. Reported objectives include data gathering, financial theft, and information or psychological operations. The actor’s targeting pattern and operational alignment indicate a Russia-linked threat focused primarily on espionage-oriented collection, with overlap into financially motivated activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.