All actors

Cyber Berkut

Also reported as Kiberberkut. Linked to Russia by three sources.

Reports
20
Last reported
Known CVEs
34
Origin
Russia
ID
cyber-berkut
Merge evidence
2 alias matches

Reports per quarter

  1. 2015 Q1: 1 report
  2. 2015 Q2: no reports
  3. 2015 Q3: no reports
  4. 2015 Q4: 1 report
  5. 2016 Q1: 1 report
  6. 2016 Q2: no reports
  7. 2016 Q3: 2 reports
  8. 2016 Q4: 3 reports
  9. 2017 Q1: 1 report
  10. 2017 Q2: 2 reports
  11. 2017 Q3: no reports
  12. 2017 Q4: 1 report
  13. 2018 Q1: 1 report
  14. 2018 Q2: no reports
  15. 2018 Q3: no reports
  16. 2018 Q4: no reports
  17. 2019 Q1: no reports
  18. 2019 Q2: no reports
  19. 2019 Q3: no reports
  20. 2019 Q4: no reports
  21. 2020 Q1: no reports
  22. 2020 Q2: no reports
  23. 2020 Q3: 1 report
  24. 2020 Q4: no reports
  25. 2021 Q1: no reports
  26. 2021 Q2: no reports
  27. 2021 Q3: no reports
  28. 2021 Q4: no reports
  29. 2022 Q1: 2 reports
  30. 2022 Q2: no reports
  31. 2022 Q3: no reports
  32. 2022 Q4: no reports
  33. 2023 Q1: no reports
  34. 2023 Q2: no reports
  35. 2023 Q3: 1 report
  36. 2023 Q4: no reports
  37. 2024 Q1: no reports
  38. 2024 Q2: no reports
  39. 2024 Q3: no reports
  40. 2024 Q4: no reports
  41. 2025 Q1: no reports
  42. 2025 Q2: no reports
  43. 2025 Q3: no reports
  44. 2025 Q4: no reports
  45. 2026 Q1: no reports
  46. 2026 Q2: 3 reports
Dated reports, 2015 Q1 to 2026 Q2.

CVEs named in reports

Show all 34 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. CyberBerkut

    date ORKL added it fromORKL

  2. Understanding Uncertainty while Undermining Democracy

    date in the title fromORKL

  3. russian-federation-country-profile.pdf

    Malpedia library date fromORKL

  4. TAINTED LEAKS Disinformation and Phishing With a Russian Nexus

    date in the CCS '25 data Citizen Lab fromORKLCCS '25 data

Show all 20 reports Show fewer
  1. Russia Hacks Bellingcat MH17 Investigation _ ThreatConnect

    file creation date fromORKL

  2. Belling the BEAR

    file creation date ThreatConnect fromORKL

  3. Belling the BEAR

    date in the title fromORKL

  4. Bartholomew-GuerreroSaade-VB2016.indd

    Malpedia library date Kaspersky fromORKL

  5. Global Threat Intel Report

    Malpedia library date Crowdstrike fromORKL

Newest first. Details opens the report in Explore.