HiddenArt is a state-level threat actor assessed with high confidence to originate from Russian network sources, specializing in mobile network surveillance and intelligence gathering. First identified as active since at least 2017, the group distinguishes itself by uniquely spoofing SS7 addresses, making them appear similar to legitimate mobile network nodes to evade detection and hinder attribution. Their primary motivation is the tracking of individuals and interception of communications, particularly targeting Russian political dissidents and VIPs.