Unknown Hacker Group Targeted Russian Maritime Universities and Diplomats for Nearly Two Years
Kaspersky reported an unattributed hacking group has conducted intermittent espionage operations against Russian organizations since at least mid-2024, with more than half of attacks over the past year targeting maritime and river transport universities that train personnel for Russia's shipping and fishing industries
Targeting concentrated on Russian maritime and river transport training institutions signals a collection requirement calibrated to an actor with interests in Russian maritime capacity, a profile Kaspersky, the sole technical source, declined to attribute to any known group. Three-to-four-month dormancy intervals between burst campaigns indicate deliberate operational pacing inconsistent with financially motivated actors. The toolkit progression from Cobalt Strike through commodity MaaS to open-source Ravage tracks a calculated reduction of attributable forensic surface. English-language financial lures alongside Cyrillic-language government and university targeting narrow the candidate sponsor pool to services with Russian-language collection requirements and English-language operational capacity, though the mixed toolkit cannot rule out a cybercriminal actor with opportunistic maritime focus.