APT Watch — Russian APT Threat Intelligence & IOC Feeds

Load a database to begin

Database Counts

Scan Classification Distribution

Subnet Tier Distribution

Active Campaign Intelligence

TLS-Camouflage Operator #110

tracked

Russian-speaking ecrime operator serving fabricated-CA TLS forgeries (fake Microsoft / Let’s Encrypt / VK authorities) from reverse proxies across several bulletproof ASNs. Per-brand campaigns tracked as facets; attribution rests on byte-identical CA-cert SHA-1 reuse.

Latest confirmation

2026-07-14

Round-2 CA sweep confirmed 1,615 hosts chaining to the operator’s fabricated minting authority. Authentic-issuer clones held as leads pending re-scan.

Partial Export — Web Database

You are viewing the web export, a lightweight snapshot optimized for browser analysis. Some tables (domains, URLs, low-severity vulnerability findings) are excluded to keep the file small enough to load client-side. For full coverage — including all domains, URLs, complete vulnerability data, and the validation queue — work with a local copy of the full database using the CLI tools.

Full Database Loaded

You have the complete dataset — all tables, all IOCs, all vulnerability findings. No data has been excluded.

IOC Feeds

Blocklist Feeds

APT-specific blocklists (apt-*) target Russian APT infrastructure only. Unified blocklists (aptw-*) merge our data with external feeds (FireHOL, StevenBlack, URLhaus, AbuseIPDB) for broader Pi-hole / firewall coverage.

Infrastructure Pattern Analysis

Patterns discovered from vulnerability scan fingerprinting — SSL certificates, port signatures, and hosting indicators that link unknown hosts to known APT infrastructure.

Pattern Details

Scan Candidates (port fingerprint match)

Quick Exports

Run a query and download the results as CSV directly from the browser.

Database Health Check

Click "Run Health Check" to analyze database integrity.

Load a database to begin

Recon Overview

Staging & Relay Servers

Servers detected as proxy/staging nodes coordinating C2 traffic. High confidence = strong proxy + multi-C2 signal.

Recon Candidates

New IPs, subnets, and ASNs identified through enrichment, subnet adjacency, and correlation analysis.

Enrichment Results

Geolocation, ASN, and hosting data gathered from online APIs for known IOCs.

ASN Intelligence Map

Top ASNs hosting threat infrastructure — ranked by IOC density.

Load a database to begin

Validation Overview

Shodan InternetDB

Free, no key

AbuseIPDB

1000/day (API key)

VirusTotal

4/min (API key)

Quick IP Lookup (browser-side)

Queries Shodan InternetDB directly from browser (free, no key). Optional VirusTotal with your API key (never stored).

VirusTotal API Key (optional):

Shodan InternetDB

VirusTotal

Validation Queue

Recent Validations

Load a database to begin

Campaign Overview

Campaigns (13)

Attribution Sources (53)

Campaign IOCs

Hosting Providers

Certificate Patterns

Takedown Targets

Load a database to begin

Russian Intelligence Agency Mapping

GRU (Military Intelligence)

Unit 26165 APT28 / Fancy Bear

Unit 74455 Sandworm / APT44

Unit 29155 Cadet Blizzard

FSB (Federal Security Service)

Center 16 Turla / Secret Blizzard

Center 18 Gamaredon / Star Blizzard

ESET Sep 2025: First inter-unit collaboration

SVR (Foreign Intelligence Service)

SVR APT29 / Midnight Blizzard

Residential proxies; hard to pin via IP

Cross-Agency Correlations (26)

Infrastructure Convergence Points

Key Intelligence Findings

GRU Infrastructure Sharing

Mandiant APT44 report confirms APT28 (Unit 26165) and Sandworm (Unit 74455) cohabitate on shared infrastructure. Microsoft documents Cadet Blizzard (Unit 29155) as a Sandworm subgroup.

FSB Inter-Unit Collaboration (NEW)

ESET September 2025: First documented FSB collaboration. Gamaredon (Center 18) deploys Turla (Center 16) Kazuar v2 backdoor via PteroGraphin loader.

SVR / Storm-2372 Overlap

Check Point + Volexity document APT29/Storm-2372 device-code phishing overlap. Shared targeting of EU diplomats with nearly identical tradecraft.

Shared BPH Ecosystem

State actors (GRU/FSB/SVR) and criminal RaaS (ALPHV, LockBit) converge on AEZA/Hetzner infrastructure. OFAC sanctions created disruption but AEZA migrated within 20 days.

Load a database to begin

Score Distribution

Lifecycle States

Provider Risk Classification

IOC Scoring Explorer

Load a database to begin

STIX 2.1 Export

Generate a STIX 2.1 bundle from scored IOCs. Filtered client-side from the loaded database.

Suricata IDS Rules

Generate Suricata alert rules for scored IPv4 IOCs.

Custom Blocklist Builder

Build a filtered blocklist using v3 scoring criteria. Output in plain IP list format (compatible with firewalls, Pi-hole, etc.).

Load a database to view its details.

Database Details

Schema, build history, data volumes, attribution activity, and the intelligence notes curated during research.