GTG-20006
GTG-20006 is a Russian espionage operator that has targeted over 20 organizations in Ukrainian and European government, defense, and diplomatic sectors, exfiltrating more than 300,000 national identity records. The actor employs an auto-rebuild loop for flagged implants to evade detection and has delivered payloads that freeze victim machines' security updates. GTG-20006 has also been linked to an intrusion into a North African government technology authority, compromising a central account server to exfiltrate a credential database. The group utilizes customized AI-driven workflows throughout its attack chain.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.