Skip to content
skopnix
← adversaries
Unknown

TA499

VovanLexus
misp-galaxyrefreshed 2026-09-15

sigil

Analyst brief

TA499, also known as Vovan and Lexus, is a Russia-aligned threat actor that has aggressively engaged in email campaigns since at least 2021. The threat actor’s campaigns attempt to convince high-profile North American and European government officials as well as CEOs of prominent companies and celebrities into participating in recorded phone calls or video chats.

Primary-source reports
Take it with you
References
Early access

Track TA499 on the wire.

Early access opens the actor API and MCP server first — and an alert every time this adversary lands on the wire. One email when it's ready.

bot-protected