File · InvisiMole · Unknown · misp-galaxy · refreshed 2026-10-06

InvisiMole

sigil · no ATT&CK coverage stated

What changed

ledger · newest first

—todaynew CVE3 new CVEs: CVE-2007-5633, CVE-2017-0144, CVE-2019-0708

Analyst brief

misp-galaxy

Adversary group targeting diplomatic missions, governmental and military organisations, mainly in Ukraine.

Observed targets (as stated by the sources)

1 countries · 1 sectors

assessed originnot stated by sourcesobserved targets · 1

countries · 1

Ukraine

sectors · 1

Government

as stated by MISP galaxy / ransomware.live — not inferred

CVEs InvisiMole is cited as exploiting

none on KEV

CVE-2007-56332026-10-17
1. “InvisiMole has exploited CVE-2007-5633 vulnerability in speedfan.sys driver to obtain kernel mode privileges.”
  cited as exploiting · source: welivesecurity.com ↗ · 2026-10-17
CVE-2017-01442026-10-17
1. “Using the EternalBlue vulnerability in the SMB protocol ( CVE-2017-0144 )”
  cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17
CVE-2019-07082026-10-17
1. “Using the BlueKeep vulnerability in the RDP protocol ( CVE-2019-0708 )”
  cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

2 sources

Track InvisiMole on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.