Given their capability and sophistication, it is unlikely that IRON RITUAL's intrusions will leave sufficient artifacts to allow researchers to associate their activities with previous or future Russian cyber espionage operations. The group has used malware including the SUNBURST (also known as Solorigate) backdoor and in-memory Cobalt Strike delivered using the TEARDROP and RAINDROP loaders. CTU researchers assess with high confidence that IRON RITUAL's intent is long term, covert access to networks of interest for the purposes of espionage and data theft.ToolsTaegis™ XDR Adversary Software Coverage Tool