For years, Russian advanced persistent threat (APT) actors have been observed launching various cyberattacks against Ukrainian targets, with some of these groups believed to be part of or under the direct supervision of Moscow’s secret service.

Over the past months, at least two Russian state-sponsored groups have been observed launching cyberattacks against Ukraine, namely Gamaredon, also known as Armageddon, Primitive Bear and Shuckworm, and potentially Sandworm, which is also referred to as Iron Viking, Telebots and Voodoo Bear.