Loading threat actor…
Shadow is a financially motivated ransomware group that has targeted large organizations in Russia, particularly major industrial enterprises. The group has also operated under the names Comet and DARKSTAR, and reporting has linked its ransomware operations to the hacktivist persona Twelve. Under the Shadow, Comet, and DARKSTAR branding, the actor has conducted extortion-driven intrusions against Russian organizations, while Twelve has been associated with destructive attacks against similar targets. Shadow has used double-extortion tactics, combining file encryption with threats to publish stolen data if victims refuse to pay. Its operations have included victim-specific negotiation portals hosted over Tor and ransom demands reaching into the millions of dollars equivalent. The group has been described as resembling a ransomware-as-a-service affiliate in its victim communication workflow, although direct confirmation that it is a formal RaaS affiliate is not established. Observed intrusion activity includes gaining access through vulnerable public-facing services, including exposed remote access infrastructure, followed by unauthorized remote administration and deployment of ransomware for both Windows and Linux environments. Shadow has used LockBit 3-derived ransomware for Windows systems and Babuk-derived ransomware for Linux systems. Additional tooling observed in its operations includes remote access and tunneling utilities used to maintain access and facilitate post-compromise activity. The actor’s known behavior supports capabilities in initial access, persistence, exfiltration, and post-exploitation, along with extortion-oriented ransomware deployment. High-confidence reporting ties the group’s campaigns to Russia-focused targeting and identifies financial gain as its dominant motivation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware/extortion group attacking organizations in Russia. The group has rebranded multiple times from Shadow to Comet and then DARKSTAR, while maintaining the same tactics and tooling. It also appears linked to the hacktivist persona Twelve, which uses similar TTPs against Russian organizations with destructive rather than financial objectives.
A newly observed ransomware group attacking large Russian companies, especially major industrial enterprises, using double-extortion tactics with Tor-based victim chat panels and demanding $1–2 million in ransom.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.