Castanet

Russian-linked Threat Actors Deploy SocGholish Malware via Fake Browser Updates

First seen 26 Nov 2025, 19:33 UTC • •30.6

Article Content

1 / 13

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Cybersecurity researchers at Arctic Wolf Labs have identified a cyberattack campaign utilizing fake browser update notifications to distribute SocGholish malware. This campaign is linked to Russian threat actors and targets unsuspecting users, potentially compromising their systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 225d ago How this analysis works

Threat Graph

13 entities, 32 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

GRU Unit 29155
RomCom
TA569

Technique (4)

Malware
Phishing
Ransomware
T1566.002 - Spearphishing Link

Organization (2)

International Red Cross
Unicef

Malware (2)

Mythic Agent
SocGholish

Affected Platform (1)

Firefox

Tool (1)

WinRar

Relationships

GRU Unit 29155 uses Mythic Agent
GRU Unit 29155 uses SocGholish
RomCom uses Mythic Agent
RomCom uses SocGholish
TA569 uses Mythic Agent
TA569 uses SocGholish
GRU Unit 29155 uses WinRar
RomCom uses WinRar
TA569 uses WinRar
GRU Unit 29155 uses Malware
GRU Unit 29155 uses Phishing
GRU Unit 29155 uses Ransomware
GRU Unit 29155 uses T1566.002 - Spearphishing Link
RomCom uses Malware
RomCom uses Phishing
RomCom uses Ransomware
RomCom uses T1566.002 - Spearphishing Link
TA569 uses Malware
TA569 uses Phishing
TA569 uses Ransomware
TA569 uses T1566.002 - Spearphishing Link
GRU Unit 29155 targets International Red Cross
GRU Unit 29155 targets Unicef
RomCom targets International Red Cross
RomCom targets Unicef
TA569 targets International Red Cross
TA569 targets Unicef
Mythic Agent targets International Red Cross
Mythic Agent targets Unicef
SocGholish targets International Red Cross
SocGholish targets Unicef
GRU Unit 29155 related to Firefox

Following this threat?

Track GRU Unit 29155, Mythic Agent and International Red Cross in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed