Loading story…
U.S. authorities unsealed indictments against three FSB officers and one TsNIIKhM employee over long-running Russian state-sponsored cyber campaigns that penetrated energy-sector organizations and, in one case, deployed TRITON malware against a foreign oil refinery’s safety systems, forcing a shutdown. A joint CISA, FBI, and DOE advisory said the operations spanned 2011 to 2018 and included the Havex malware campaign, remote access to energy networks, theft of enterprise and ICS-related data, and activity consistent with operational preparation against critical infrastructure.
Separate reporting and industry analysis tied related Russian-linked activity to Energetic Bear/Dragonfly/TEMP.Isotope, a cluster associated with intrusions into U.S. state and local government networks and earlier compromises of electric utilities and other critical infrastructure. Officials said some election-support IT systems were accessed in limited cases, but there was no evidence that vote tabulation systems, voting machines, or election data integrity were affected; defenders were urged to strengthen IT/ICS segmentation, apply patches, enforce MFA, restrict remote access, and follow established industrial control system guidance such as NIST SP 800-82.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
On 2022-03-24, the UK publicly attributed historic cyber incidents to the FSB's Centre 16, which NCSC said is almost certainly tracked as Energetic Bear, Berserk Bear, and Crouching Yeti. The UK also sanctioned TsNIIKhM for the 2017 Saudi petrochemical plant safety-system incident involving malware capable of causing dangerous physical consequences.
On March 24, 2022, CISA, the FBI, and the DOE jointly published a cybersecurity advisory detailing Russian state-sponsored intrusion campaigns against the energy sector from 2011 to 2018 and recommending mitigations for U.S. defenders.
On March 24, 2022, the U.S. Department of Justice unsealed indictments against three FSB officers and one TsNIIKhM employee for historical hacking campaigns targeting critical infrastructure, including energy sector intrusions and the 2017 TRITON operation.
On November 4, an analysis argued that Energetic Bear was most likely aligned with Russia’s non-military intelligence services, the FSB or SVR, rather than the GRU, and characterized its mission as espionage and operational preparation of the environment.
CyberScoop reported on October 19 that Mandiant had attributed multiple recent intrusions into U.S. state and local networks to TEMP.Isotope, also known as Energetic Bear, based in part on previously associated IP addresses and exploitation of the Microsoft authentication flaw.
On October 9, the FBI and CISA publicized a campaign involving breaches of some election support systems used by state and local officials, while stating the affected systems were not used to tally votes and that there was no evidence election data integrity had been compromised.
On September 18, CISA ordered all federal civilian agencies to update software to address a recently disclosed Microsoft authentication protocol vulnerability later cited in suspected Russian intrusions.
In 2017, Russian actors tied to TsNIIKhM compromised a Middle East-based energy sector organization and used TRITON malware to manipulate a foreign oil refinery’s safety systems, forcing a shutdown for several days.
Beginning in 2016, FSB-linked actors broadly targeted U.S. energy sector networks through a two-stage operation that first compromised third-party vendors, integrators, and suppliers before pivoting into victim enterprise environments.
From 2013 through 2014, the same Russian threat actor leveraged Havex malware on energy sector networks, using spearphishing, compromised websites, and Trojanized ICS vendor software updates to gain access and collect ICS-related information.
A joint CISA/FBI/DOE advisory states that FSB-linked Russian actors began a multi-stage campaign targeting U.S. and international energy sector organizations in 2011, seeking remote access to victim networks and later exfiltrating enterprise and ICS-related data.
After the TRITON incident, Schneider Electric issued a patch to mitigate the attack vector used against Triconex safety systems. The source does not explicitly anchor the patch to a specific date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcegov.uk
Open sourceus-cert.cisa.gov
Open sourcepylos.co
Open sourcecyberscoop.com
Open sourcecrowdstrike.com
Open sourcecsrc.nist.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. officials stepped up warnings and coordination with industry over potential Russian cyberattacks tied to the Ukraine crisis, urging organizations to report signs of reconnaissance, exploitation testing, malware development, and compromises involving industrial control systems. The FBI, CISA, DHS, NSA, Treasury, Energy Department, and allied partners increased intelligence sharing and defensive preparations as officials cited the risk that destructive activity already hitting Ukrainian entities could spill over to U.S. and foreign companies with operations in Ukraine, particularly across **energy, healthcare, finance, and other critical infrastructure** sectors. The concern was grounded in a documented history of Russian operations against operational technology and the energy sector. Prior U.S. government reporting detailed campaigns targeting critical infrastructure, while Treasury sanctioned a Russian state research institution linked to the **Triton/Trisis** malware used against Schneider Electric safety systems. The Justice Department later charged four Russian government-linked individuals over the **Triton/Trisis** and **Dragonfly/Havex** campaigns, alleging long-running efforts to compromise **SCADA** and industrial control environments at hundreds of organizations in roughly 135 countries to enable future disruption or physical damage.
Aug 15, 2026
The UK National Cyber Security Centre, FBI, NSA, and CISA warned that Russia’s Foreign Intelligence Service (**SVR**), also tracked as **APT29** and **Nobelium**, is running a broad cyber-espionage campaign that combines mass exploitation of known vulnerabilities with targeted intrusions against governments, diplomats, think tanks, technology firms, financial institutions, and cloud environments. Officials said the group scans the internet for unpatched systems and exploits long-known perimeter flaws including `CVE-2019-19781`, `CVE-2019-11510`, `CVE-2018-13379`, and `CVE-2020-5902`, then uses compromised accounts to move deeper into victim networks and, in some cases, into connected supply chains. The campaign builds on tradecraft previously tied to the **SolarWinds Orion** compromise and later phishing and cloud-focused operations attributed to the SVR. U.S. and allied advisories said the service has shifted toward stealthier methods such as password spraying, abuse of mailbox and cloud permissions, temporary email infrastructure, and reduced reliance on custom malware, though earlier operations also used tools such as **SUNBURST**, **TEARDROP**, **Cobalt Strike Beacon**, and **WELLMESS**. Microsoft separately reported that Nobelium targeted thousands of accounts across hundreds of organizations in a focused espionage effort, while defenders were urged to prioritize patching internet-facing systems, enforce multi-factor authentication, audit identity and mailbox permissions, and investigate signs of lateral movement and account abuse.
Aug 15, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026