Threat intelligence / Campaign

C0026

[C0026](https://attack.mitre.org/campaigns/C0026) was a campaign identified in September 2022 that included the selective distribution of [KOPILUWAK](https://attack.mitre.org/software/S1075) and [QUIETCANARY](https://attack.mitre.org/software/S1076) malware to previous [ANDROMEDA](https://attack.mitre.org/software/S1074) malware victims in Ukraine through re-registered [ANDROMEDA](https://attack.mitre.org/software/S1074) C2 domains. Several tools and tactics used during [C0026](https://attack.mitre.org/campaigns/C0026) were consistent with historic [Turla](https://attack.mitre.org/groups/G0010) operations.(Citation: Mandiant Suspected Turla Campaign February 2023)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[C0026](https://attack.mitre.org/campaigns/C0026) was a campaign identified in September 2022 that included the selective distribution of [KOPILUWAK](https://attack.mitre.org/software/S1075) and [QUIETCANARY](https://attack.mitre.org/software/S1076) malware to previous [ANDROMEDA](https://attack.mitre.org/software/S1074) malware victims in Ukraine through re-registered [ANDROMEDA](https://attack.mitre.org/software/S1074) C2 domains. Several tools and tactics used during [C0026](https://attack.mitre.org/campaigns/C0026) were consistent with historic [Turla](https://attack.mitre.org/groups/G0010) operations.(Citation: Mandiant Suspected Turla Campaign February 2023)

12 recorded

Relationships

uses

Malware

uses

to Archive via Utility

Technique

uses

to Arp

Tool

uses

to Data from Local System

Technique

uses

to Data Transfer Size Limits

Technique

uses

Technique

uses

to Dynamic Resolution

Technique

uses

to Ingress Tool Transfer

Technique

uses

Malware

uses

to Net

Tool

uses

Tool

uses

Malware

2 external

References

mitre-attack

C0026

Mandiant Suspected Turla Campaign February 2023

https://www.mandiant.com/resources/blog/turla-galaxy-opportunity