Threat actor · all actors

Void RabisuMISP-9766d52e unknown

aka Void Rabisu, Tropical Scorpius

Last updated: 2026-10-16

2attributed CVEs

0ATT&CK techniques

4.5IDF score (tooling uniqueness)

0exclusive CVEs

2020–2022years active

About this actor

Void Rabisu is an intrusion set associated with both financially motivated ransomware attacks and targeted campaigns on Ukraine and countries supporting Ukraine.

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

Palo Alto Unit 42constellation names

Tropical Scorpius

Unclassifiedno scheme matched

Void Rabisu

How we know this

Data origin: MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques: No ATT&CK techniques mapped.
Named victims: None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

CVE publishedKEV added

2022 — 1 CVE published, 1 KEV added
2021 — 1 KEV added
2020 — 1 CVE published

Profile

CVE	Risk	CVSS	EPSS	Published	Products
`CVE-2022-24521` KEV	8.5	7.8	0.0868	2022-04-15	see CVE
`CVE-2020-1472` KEV	7.5	5.5	0.9951	2020-08-17	see CVE

No techniques attributed.

Co-occurring actors

AnonOps 2 shared CVEs
LAPSUS$ 2 shared CVEs
RomCom 2 shared CVEs
COMP-NVIDIA-VALEO 2 shared CVEs
NOTROBIN 1 shared CVEs
COMP-MICROSOFT-SALESFORCE 1 shared CVEs
Dragonfly 1 shared CVEs
APT19 1 shared CVEs
Equation 1 shared CVEs
l group 1 shared CVEs