Ukraine Cyber Operations

Curated Intelligence is working with analysts from around the world to provide useful information to organisations in Ukraine looking for additional free threat intelligence. Slava Ukraini. Glory to Ukraine. (Blog | Twitter | LinkedIn)

Resources

• Timeline of 2022 Threat Reports

  • January Threat Reports

  • February Threat Reports

  • March Threat Reports

  • April Threat Reports

  • May Threat Reports

  • June Threat Reports

  • July Threat Reports

  • August Threat Reports

  • September Threat Reports

  • October Threat Reports

  • November Threat Reports

  • December Threat Reports

• Timeline of 2023 Threat Reports

  • January Threat Reports

  • February Threat Reports

  • April Threat Reports

• Vendor Support

• Vetted OSINT Sources

• Miscellaneous Resources

• Equinix Threat Analysis Center (ETAC) contributions:

  • Contextualized Indicators of Compromise (IOCs) by ETAC (Last updated 25 March 2022)
  • Contextualized CERT-UA IOCs - see here (Last updated 28 March 2022)
  • Vetted YARA rule collection by ETAC (Last updated 4 April 2022)
  • Graphic of a Timeline of Russia-Ukraine Cyberwar (Last updated 14 March 2022)
  • Graphic of a Map of Russia-Ukraine Cyberwar (Last updated 3 March 2022 )

• KPMG-Egyde Contributions:

  • Added loosely-vetted IOC Threat Hunt Feeds (h/t 0xDISREL) (Last updated 7 April 2022)
  • IOCs shared by these feeds are LOW-TO-MEDIUM CONFIDENCE we strongly recommend NOT adding them to a blocklist
  • These could potentially be used for THREAT HUNTING and could be added to a WATCHLIST
  • IOCs are generated in MISP COMPATIBLE CSV format
  • Additional Threat Hunt Feed for recently registered Ukrainian domain names (h/t DomainTools)
  • Additional Threat Hunt Feed for threat groups targeting Ukraine (h/t RecordedFuture)
  • Ukrainain organizations offered by Access and Data Brokers on underground forums

Graphics by ETAC

Vendor Support

Vetted OSINT Sources

Miscellaneous Resources

Note:

Curated Intel does not support, encourage, partake, or condone hacking, attacking or targeting users of any kind. This information is clearly meant to help cybersecurity teams supporting Ukraine still doing their jobs while dealing with the Russian invasion.