OldGremlin extortion campaign targeting Russian industrial enterprises
Campaign
Summary
Hide ▲
Show ▼
OldGremlin has resumed extortion attacks against Russian industrial enterprises, creating renewed operational risk for as many as eight large domestic targets. The group used phishing email campaigns to deliver the initial access path and move the activity into victim environments. The reported timeframe places the operation in the first half of 2025, indicating an active and continuing campaign thread. The scope suggests a targeted, multi-victim extortion operation rather than an isolated intrusion.
Related Happenings
UnsolicitedBooker Central Asian telecom phishing campaign
Campaign
H score31
First: 24.02.2026 11:54
Last: 24.02.2026 11:54
Sources 1
About this happening:
The UnsolicitedBooker cluster shifted its phishing operation to telecommunications companies in Kyrgyzstan and Tajikistan, extending a multi-month campaign that matters be...
UnsolicitedBooker Central Asian telecom phishing campaign
CampaignAbout this happening: The UnsolicitedBooker cluster shifted its phishing operation to telecommunications companies in Kyrgyzstan and Tajikistan, extending a multi-month campaign that matters be...
ShinyHunters vishing campaign targeting SSO accounts
Campaign
H score84
First: 02.02.2026 15:46
Last: 02.02.2026 15:46
Sources 1
About this happening:
The ShinyHunters group ran a voice phishing campaign against single sign-on (SSO) accounts at Okta, Microsoft, and Google, widening risk across more than 100 hig...
ShinyHunters vishing campaign targeting SSO accounts
CampaignAbout this happening: The ShinyHunters group ran a voice phishing campaign against single sign-on (SSO) accounts at Okta, Microsoft, and Google, widening risk across more than 100 hig...
Latest development: 26.05.2026 22:46
ShinyHunters claims it breached Charter Communications on April 1 by vishing an employee's Microsoft Entra account, then used that access to export millions of consumer and business customer records from the company's Salesforce instance; Charter says no sensitive personal information or CPNI was exfiltrated.
Mem3nt0 mori Operation ForumTroll espionage campaign
Campaign
H score40
First: 28.10.2025 18:00
Last: 28.10.2025 18:00
Sources 1
About this happening:
Mem3nt0 mori ran Operation ForumTroll, a targeted espionage campaign that used personalized phishing and a Google Chrome zero-day to infect victims in Russia and...
Mem3nt0 mori Operation ForumTroll espionage campaign
CampaignAbout this happening: Mem3nt0 mori ran Operation ForumTroll, a targeted espionage campaign that used personalized phishing and a Google Chrome zero-day to infect victims in Russia and...
Qilin ransomware-as-a-service affiliate campaign targeting five countries
Campaign
H score50
First: 27.10.2025 18:45
Last: 27.10.2025 18:45
Sources 1
About this happening:
Qilin ransomware-as-a-service affiliates sustained a multi-country campaign through 2H 2025, keeping leak-site pressure high and showing repeatable extortion activity....
Qilin ransomware-as-a-service affiliate campaign targeting five countries
CampaignAbout this happening: Qilin ransomware-as-a-service affiliates sustained a multi-country campaign through 2H 2025, keeping leak-site pressure high and showing repeatable extortion activity....
PhantomCaptcha spear-phishing campaign targeting Ukraine war relief organizations
Campaign
H score36
First: 22.10.2025 19:55
Last: 22.10.2025 19:55
Sources 1
About this happening:
PhantomCaptcha was a single-day spear-phishing campaign on October 8, 2025 that targeted Ukraine war relief groups and Ukrainian regional government administrati...
PhantomCaptcha spear-phishing campaign targeting Ukraine war relief organizations
CampaignAbout this happening: PhantomCaptcha was a single-day spear-phishing campaign on October 8, 2025 that targeted Ukraine war relief groups and Ukrainian regional government administrati...
Timeline
-
06.09.2025 18:13 2 articles · 10mo ago
Initial report: OldGremlin extortion campaign targeting Russian industrial enterprises
Initial DisclosureIn the opening phase, OldGremlin used phishing emails to target employees at Russian industrial enterprises and start the extortion operation in 2025.
Show sources
- Noisy Bear Campaign Targeting Kazakhstan Energy Sector Outed as a Planned Phishing Test — thehackernews.com — 06.09.2025 18:13
- Noisy Bear Campaign Targeting Kazakhstan Energy Sector Outed as a Planned Phishing Test — thehackernews.com — 06.09.2025 18:13