Russian GRU Targeting Western Logistics Entities and Technology Companies
What it means
CISA Cybersecurity Advisories ha pubblicato un advisory sul ransomware Russian GRU Targeting Western Logistics Entities and Technology Companies. Le misure indicate vanno confrontate con esposizione, identita, segmentazione e capacita di ripristino.
Why it matters
L'advisory descrive attivita ransomware osservate e misure difensive pubblicate da un'autorita. Non prova che il proprio perimetro sia compromesso, ma richiede una verifica prioritaria di esposizione e controlli.
Recommended actions
- Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.
- Verificare sistemi esposti, accessi remoti e versioni rispetto all'advisory ufficiale.
- Confermare che backup offline e immutabili siano separati e ripristinabili.
- Correlare TTP e IOC pubblicati con la telemetria autorizzata del proprio perimetro.
Potential operational benefits
- Prioritizzazione delle esposizioni Internet e delle vulnerabilita sfruttate
- Verifica dei controlli su accessi remoti, movimento laterale ed esfiltrazione
- Validazione documentata della capacita di ripristino
Translation in progress
The official content is available in the original language. The Italian version will be published once automated checks are complete.
Text acquired from the source
Cybersecurity Advisory Russian GRU Targeting Western Logistics Entities and Technology Companies Last Revised April 17, 2026 Alert Code AA25-141A CISA Product Feedback Survey Related topics: Cybersecurity Best Practices , Critical Infrastructure Security and Resilience Executive Summary This joint cybersecurity advisory (CSA) highlights a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This includes those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. Since 2022, Western logistics entities and IT companies have faced an elevated risk of targeting by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (85th GTsSS), military unit 26165—tracked in the cybersecurity community under several names (see “ Cybersecurity Industry Tracking ”). The actors’ cyber espionage-oriented campaign, targeting technology companies and logistics entities, uses a mix of previously disclosed tactics, techniques, and procedures (TTPs). The authoring agencies expect similar targeting and TTP use to continue. Executives and network defenders at logistics entities and technology companies should recognize the elevated threat of unit 26165 targeting, increase monitoring and threat hunting for known TTPs and indicators of compromise (IOCs), and posture network defenses with a presumption of targeting. This cyber espionage-oriented campaign targeting logistics entities and technology companies uses a mix of previously disclosed TTPs and is likely connected to these actors’ wide scale targeting of IP cameras in Ukraine and bordering NATO nations. The following authors and co-sealers are releasing this CSA: United States National Security Agency (NSA) United States F
Indicatori CISA verificabili
78 valori IOC dalla fonte ufficiale. Non sono una lista di blocco automatica: verificare data, contesto e applicabilita.
Ultima verifica: 2026-09-26T13:31:59.385064+00:00
Scarica STIX 2.1| Tipo | Indicatore (non cliccabile) | File |
|---|---|---|
| ipv4-addr | 91[.]149[.]253[.]20 | |
| ipv4-addr | 70[.]34[.]254[.]245 | |
| ipv4-addr | 91[.]149[.]253[.]198 | |
| ipv4-addr | 70[.]34[.]253[.]247 | |
| ipv4-addr | 213[.]134[.]184[.]167 | |
| ipv4-addr | 91[.]149[.]253[.]118 | |
| ipv4-addr | 70[.]34[.]253[.]13 | |
| ipv4-addr | 212[.]127[.]78[.]170 | |
| ipv4-addr | 91[.]149[.]223[.]130 | |
| ipv4-addr | 70[.]34[.]252[.]222 | |
| ipv4-addr | 194[.]187[.]180[.]20 | |
| ipv4-addr | 91[.]149[.]219[.]23 | |
| ipv4-addr | 70[.]34[.]252[.]186 | |
| ipv4-addr | 192[.]162[.]174[.]67 | |
| ipv4-addr | 91[.]149[.]219[.]158 | |
| ipv4-addr | 70[.]34[.]252[.]168 | |
| ipv4-addr | 185[.]234[.]235[.]69 | |
| ipv4-addr | 91[.]149[.]203[.]73 | |
| ipv4-addr | 70[.]34[.]245[.]215 | |
| ipv4-addr | 178[.]37[.]97[.]243 | |
| ipv4-addr | 91[.]149[.]202[.]215 | |
| ipv4-addr | 70[.]34[.]244[.]100 | |
| ipv4-addr | 178[.]235[.]191[.]182 | |
| ipv4-addr | 90[.]156[.]4[.]204 | |
| ipv4-addr | 70[.]34[.]243[.]226 | |
| ipv4-addr | 147[.]135[.]209[.]245 | |
| ipv4-addr | 89[.]64[.]70[.]69 | |
| ipv4-addr | 70[.]34[.]242[.]220 | |
| ipv4-addr | 138[.]199[.]59[.]43 | |
| ipv4-addr | 83[.]29[.]138[.]115 | |
| ipv4-addr | 64[.]176[.]71[.]201 | |
| ipv4-addr | 95[.]215[.]76[.]209 | |
| ipv4-addr | 83[.]23[.]130[.]49 | |
| ipv4-addr | 64[.]176[.]70[.]238 | |
| ipv4-addr | 93[.]105[.]185[.]139 | |
| ipv4-addr | 83[.]168[.]78[.]55 | |
| ipv4-addr | 64[.]176[.]70[.]18 | |
| ipv4-addr | 91[.]221[.]88[.]76 | |
| ipv4-addr | 83[.]168[.]78[.]31 | |
| ipv4-addr | 64[.]176[.]69[.]196 | |
| ipv4-addr | 91[.]149[.]255[.]195 | |
| ipv4-addr | 83[.]168[.]78[.]27 | |
| ipv4-addr | 64[.]176[.]67[.]117 | |
| ipv4-addr | 91[.]149[.]255[.]19 | |
| ipv4-addr | 83[.]168[.]66[.]145 | |
| ipv4-addr | 46[.]248[.]185[.]236 | |
| ipv4-addr | 109[.]95[.]151[.]207 | |
| ipv4-addr | 91[.]149[.]255[.]122 | |
| ipv4-addr | 83[.]10[.]46[.]174 | |
| ipv4-addr | 46[.]112[.]70[.]252 | |
| ipv4-addr | 209[.]14[.]71[.]127 | |
| ipv4-addr | 91[.]149[.]254[.]75 | |
| ipv4-addr | 79[.]185[.]5[.]142 | |
| ipv4-addr | 31[.]42[.]4[.]138 | |
| ipv4-addr | 162[.]210[.]194[.]2 | |
| ipv4-addr | 103[.]97[.]203[.]29 | |
| ipv4-addr | 91[.]149[.]253[.]204 | |
| ipv4-addr | 79[.]184[.]25[.]198 | |
| ipv4-addr | 31[.]135[.]199[.]145 | |
| ipv4-addr | 192[.]162[.]174[.]94 | |
| email-addr | maint[@]goldenloaduae[.]com | |
| email-addr | jayam[@]wizzsolutions[.]com | |
| email-addr | commerical[@]vanadrink[.]com | |
| email-addr | tv[@]coastalareabank[.]com | |
| ipv4-addr | 124[.]168[.]91[.]178 | |
| ipv4-addr | 159[.]196[.]128[.]120 | |
| ipv4-addr | 194[.]126[.]178[.]8 | |
| email-addr | sarah[@]cosmicgold469[.]co[.]za | |
| email-addr | ashoke[.]kumar[@]hbclife[.]in | |
| email-addr | m[.]salim[@]tsc-me[.]com | |
| email-addr | mdelafuente[@]ukwwfze[.]com | |
| email-addr | md-shoeb[@]alfathdoor[.]com[.]sa | |
| email-addr | franch1[.]lanka[@]bplanka[.]com | |
| email-addr | karina[@]bhpcapital[.]com | |
| email-addr | vikram[.]anand[@]4ginfosource[.]com | |
| email-addr | accounts[@]regencyservice[.]in | |
| ipv4-addr | 207[.]244[.]71[.]84 | |
| ipv4-addr | 213[.]32[.]252[.]221 |
Provenance
Allegato ufficiale CISA · 2026-04-17T18:27:37Z
SHA-512: a3b6fb5f09046d2f913072e362a898c48ef76b49c1dbb7a14c40819d8d74712f26a4b4943d1fa3e92385906d737fbd9aaecff75459373857eba97ac11d1f7a80
- Source
- CISA Cybersecurity Advisories
- Publishing entity
- CISA
- Entity type
- National authority
- Area
- North America · US
- Original language
- en · translation in preparation
- Publication
- 17/04/2026 14:00
- Sharing
- TLP:CLEAR
- MITRE ATT&CK
- T1003.003, T1021.001, T1029, T1048, T1053.005, T1056, T1059, T1059.001, T1059.003, T1059.005, T1059.006, T1070.001, T1087.002, T1090.002, T1090.003, T1098.002, T1104, T1110, T1110.001, T1110.003, T1111, T1114, T1114.002, T1119, T1125, T1133, T1187, T1190, T1199, T1204.001, T1204.002, T1547.001, T1547.009, T1552.006, T1556.006, T1560, T1560.001, T1566, T1566.001, T1566.002, T1566.004, T1573, T1574.001, T1586.002, T1586.003, T1589.002, T1591, T1591.002, T1591.004, T1592, T1627, T1627.001, T1659, T1665
- CVE
- CVE-2023-23397, CVE-2020-12641, CVE-2020-35730, CVE-2021-44026, CVE-2023-38831
- Classification
- Critical
- Stated country
- US
Affected products and versions
The collector will check NVD and the available official vendor advisories.
Action indicated by the source
Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.