Russian-aligned digital threat groups and cybercriminal organizations:

Venomous Bear, also known as Turla. The group has become known for waging stealthy cyberespionage attacks on high-level targets like governmental services and strategic industries with malware tools of its own design.

TA542, also known as Mummy Spider and by other monikers, a criminal hacking group that has distributed the Emotet malware.

GRU’s Main Center of Special Technologies, known more commonly as Sandworm. The military unit has gained international notoriety as one of Russia’s most prolific hacking groups and has been implicated in the 2016 DNC hack, repeated hacks of the Ukrainian power grid, the 2018 Winter Olympics breach and the devastating NotPetya malware outbreak.