Skip to content
Install MCP

Threat actor

NtechLab

Last fetched

NtechLab is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

The Russian company NtechLab operates Russia’s extensive biometric mass surveillance system. This system has reportedly facilitated numerous arbitrary arrests of Russian citizens identified through NtechLab's biometric recognition technology, often during peaceful demonstrations. In July 2023, the European Union imposed sanctions on NtechLab for its involvement in serious human rights violations in Russia. NtechLab is also behind FindFace, a powerful facial recognition app that quickly gained popularity for its ability to identify individuals with high accuracy by comparing photos to profile pictures on the Russian social networking site Vkontakte. The company operates as a subsidiary of Rostec, a Russian state-owned corporation.

Techniques by tactic

No ATT&CK techniques are recorded for NtechLab in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to NtechLab today — this states the absence of a published link, not that NtechLab has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from NtechLab into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.