UnattributedUnattributedMixedActive 2022 – 2025
Shedding Zmiy
Summary
Active since beginning of 2022, attacking dozens of Russian companies in energy, public sector, IT, and telecommunications. Reported by Solar 4RAYS researchers. Operations coincide with the start of the Ukraine-Russia conflict. Limited public IOCs due to Russian-origin research publications with restricted international distribution.
Attribution
UnattributedNo state attribution: Unattributed
Pro-Ukrainian per Solar 4RAYS; espionage, leaks, wipers
Tracked by researchers; no state or organisation has been publicly attributed.
Sources
- Solar 4RAYS, via Anti-Malware.ru (Research, 2024-05-24)
Not financially motivated; steals data for later attacks
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Government-sector intrusion via dismissed employees' VPN accounts ('Dead souls') | 2025-04 – 2025-11 | Russia | Government | Solar 4RAYS (2026-04-09) — VPN access from April 2025 with stale accounts of dismissed staff, PostgreSQL command execution, dozens of Unix hosts, ≥6 months of espionage; IR engaged November 2025; Bulldog Backdoor, Megatsune (Kitsune) rootkit, gs-netcat |
| Russian Energy & Public Sector Campaign | 2022 – 2024 | Russia | Energy, Government, IT | Solar 4RAYS via Anti-Malware.ru (2024-05-24) — espionage APT active in Russia since 2022, several dozen attacks on government, industry, telecom and other critical sectors; 35 tools, ~20 exploited vulnerabilities |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 4
| Initial Access3 | T1566.001Spearphishing AttachmentT1199Trusted RelationshipT1190Exploit Public-Facing Application |
|---|---|
| Stealth1 | T1574.001DLL |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| Bulldog Backdoor | Backdoor with web C2 panel | Linux/Windows |
| Megatsune / Kitsune rootkit | Linux rootkit (credential and SSH-key harvesting) | Linux |
| Puma | Kernel-level rootkit | Linux |
| XDHijack | Loader | Windows |
Infrastructure patterns
- Many C2 servers on Russian cloud and hosting providers to evade GeoIP blocking (Solar 4RAYS, 2024)
- GSocket relays and cloudflared proxy tunnel its access (Solar 4RAYS, 2026)