This map was created to make the results of our APT Russian Ecosystem
research accesible. We recommend to read the full research in order to use this map in its full context.
The russian APT map is a web-based, interactive map that shows the different families and actors that are
part of the Russian APT ecosystem, as well as the connections between them. The map is basically a one stop
shop for anyone who is interested to learn and understand the connections and attributions of the samples,
modules, families and actors that together are building this ecosystem.
The map in intuitive and rich with information. The user can get a full overview of the ecosystem or drill
down into specific connections. By clicking on nodes in the graph, a side panel will reveal, containing
information about the malware family the node belongs to, as well as links to analysis reports on Intezer’s
platform and external links to related articles and publications. Basically, this side-panel is a short
identity-card of the entities in the map.
Along with this map we also created a tool we named Russian APT Detector. It wraps a set of Yara rules produced by Intezer’s platform. The rules contain byte-sequences of popular mutual code between one or more samples. We then wrapped it up in a binary to ease the use of the tool. The tool, the Yara ruleset and more information is available on our Github Repository.
The map and its data are open source in our repository and we are inviting
you all to add more information and improve it.
