HOMETHREATSMail-O
APT / THREAT GROUP

Mail-O

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.mail_o

Threat Analysis

Mail-O is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.group-ib.com/task
→https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/
→https://rt-solar.ru/upload/iblock/b55/Ataki-na-FOIV_otchet-NKTSKI-i-Rostelekom_Solar_otkrytyy.pdf
→https://therecord.media/fsb-nktski-foreign-cyber-mercenaries-breached-russian-federal-agencies/
→https://www.sentinelone.com/labs/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

Mail-Owin.mail_o

External Intelligence

Malpedia: win.mail_o

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Mail-O
Mail-O — APT / Threat Group | Threat Intelligence | CTIWATCH.COM