Skip to content
You can now search across every topic, entity and event.What's new
FrostArmada
Organisation

FrostArmada

A threat cluster tracked internally by ReliaQuest, cited as a tradecraft overlap with the hotel router campaign.

FrostArmada is the internal threat-cluster label ReliaQuest cited as a tradecraft overlap with a hotel WiFi credential-theft campaign it reported on 23 July 2026.

Last refreshed: 3 August 2026 · Appears in 1 active topic

Key Question

Is FrostArmada the same threat actor as APT28?

Timeline for FrostArmada

#12 26 Jul

One firm hedged, heise online named APT28

Cybersecurity: Threats and Defences
View full timeline →
Follow Cybersecurity: Threats and Defences →

Background

FrostArmada is a threat cluster tracked internally by ReliaQuest. Almost nothing about it is public beyond that single reference: ReliaQuest cited tradecraft overlap with FrostArmada when assessing a hotel WiFi credential-theft campaign, while explicitly stating the current activity differs from FrostArmada's prior behaviour.

No nationality, state sponsorship or link to a named advanced persistent threat group is established for FrostArmada in current reporting; heise online's separate attribution of the hotel WiFi campaign to APT28 is heise online's own claim, not ReliaQuest's, and does not establish FrostArmada as APT28.

This page is deliberately short and will stay that way until independent reporting says more about the cluster than ReliaQuest's single reference.

Common Questions
What is FrostArmada?
FrostArmada is a threat-cluster name used internally by the security firm ReliaQuest, not a widely recognised industry designation; almost nothing about it is publicly documented beyond ReliaQuest's own reference.Source: ReliaQuest hotel router campaign assessment
Is FrostArmada the same as APT28?
Not confirmed. ReliaQuest reported only tradecraft overlap with FrostArmada at low-to-medium confidence and did not name APT28. A separate outlet, heise online, named APT28 directly, but that attribution has not been corroborated by ReliaQuest itself.Source: ReliaQuest hotel router campaign assessment; heise online
Why is FrostArmada's link to the hotel WiFi campaign uncertain?
ReliaQuest said the current campaign differs from prior FrostArmada activity in several respects and rated the tradecraft overlap only low-to-medium confidence, so the label describes a partial resemblance, not a confirmed identification.Source: ReliaQuest hotel router campaign assessment