Hacker groups

Hackers

Main article: Hackers

Chronicle

2025

14 cyber groups that most actively carry out attacks on Russian companies

The Kaspersky Cyber ​ ​ Threat Intelligence team identified 14 cyber groups that most actively carry out attacks on Russian organizations. Among them are hacktivists who appeared in the domestic cyberlandschaft after 2022 and publicly position themselves as pro-Ukrainian formations. For the first time, the researchers conducted a comprehensive technical analysis of the tactics, methods and procedures of these attackers, and also confirmed the existence of ties between groups. The study was published on September 4, 2025.

According to the press service of Kaspersky Lab, experts have grouped attackers into three clusters based on motivation and the tools used. The classification made it possible to identify systemic patterns in the activities of cybercriminals and their coordination during operations against Russian companies.

𝓲

Фото: Freepik

The first cluster is composed of hacktivists, acting for ideological reasons in order to destroy the corporate infrastructure in Russia. This category includes groupings:

• TWELVE
• BlackJack
• Head Mare
• C.A.S
• Crypt Ghouls

The second cluster is represented by APT groups specializing in complex targeted cyber espionage campaigns. These include:

• Awaken Likho
• Angry Likho
• GOFFEE
• Cloud Atlas
• Librarian Likho (formerly known as Librarian Ghouls)
• Mythic Likho
• XDSpy

The third hybrid cluster unites attackers with unique methods of work:

• BO TEAM
• Cyberpartisans

The study proved the interaction of most of the studied formations. Groups use identical tools and distribute roles in operations against Russian enterprises. Some provide initial access to systems, others are engaged in fixing in networks and causing damage to targets.^[1]

Who and where is attacking Russia? TAdviser released a map of cyber groups and their targets

In Russia, after the imposition of sanctions, the digitalization of all industries not only did not stop, it accelerated, since it became clear to everyone that it was necessary to switch to a new technological base - clouds, web services and container technologies of mainly domestic production. And the more digital public administration, finance and industry are, the more they attract the attention of hackers from around the world. That is why Russian information systems attack not only cyber warfare from unfriendly countries, but also groups based in friendly countries and even in Russia itself.

Attribution

It should be noted that determining the location of a particular grouping (attribution) is sufficient conditionally. Some research companies at one time identified and described the tactics and techniques of some hackers and tied them to certain countries. This was often done by the encodings or hours of activity used. If the Russian language was used, then the link to Russia followed, although Ukrainian and Belarusian specialists can also use the same Russian language and live in about the same hour zone. This is also the case with Asian cyber groups.

Since no one denied the binding of groups to specific countries, everyone else also began to refer to the already known attribution of hackers. Further, if the new group borrowed something from old malicious techniques or tools, it was attributed the same attributes that the parent group had. It should be noted that if the group is localized in a particular country, then this does not mean that the government of this country is cooperating with it. In our map, we tried to adhere to the names of the groups that Russian researchers gave in their reports.

However, some hacker groups used methods and tools that could be tied to several country groups, so their presence could not be localized. There were also completely new hacker communities that could be international. For example, when using legitimate remote control tools or network administration, it is difficult to determine the style of attack, and therefore bind it to a specific group or school. Therefore, there are quite a few names in our map that do not have a clear localization.

Attack targets

The map is based on analytical reports of Russian companies such as Kaspersky Lab, BI.Zone or F6, but the mention in foreign reports was also recorded. These reviews quite often indicate approximate goals that are pursued by attackers of a particular group. We structured them into five large clusters:

• State. This includes not only state information systems, but also regional and municipal sites, resources of state institutions and departments, as well as other digital assets, one way or another related to the activities of the state. In general, the failure of such resources can affect the quality of public administration;
• Industrial. Of course, here most often attacks occur on defense industry enterprises, but the oil and gas and energy sectors are also classified by us as industrial facilities, attacks on which can lead to serious consequences, including for citizens;
• Scientific. This category includes educational resources, as well as various scientific institutions that are closely related to industry. They are engaged in the development of intellectual property, which is important for the economy of the state. Their disabling is rarely noticed, but attacks on them are often associated with espionage and influence on the development of industrial technologies and, in general, the country's economy;
• Commercial. This category includes all commercial enterprises, such as retailers, marketplaces, digital platforms, providers, IT companies and other commercial enterprises that provide services. The failure of these resources mainly results in economic losses and inconveniences only for their customers;
• Banking. Although banks and insurance companies can be classified as commercial - they also provide services. However, their failure affects not only the company itself, but can cause financial damage to a large segment of the economy, so we have separated them into a separate category.

However, not all reports on the activities of groups indicated the final goals of hacker activities. Therefore, many groups are not tied to specific industry goals. This generally means that their attacks are not targeted - they have been tied to other parameters.

The fame of the groups

Most hacker groups do not like to glow, so as not to attract attention to their activities. However, there are organizations that, on the contrary, try to talk as widely as possible about their operations. Often these are ransomware platforms and pro-Ukrainian groups. At the same time, we tried to use not their self-names to designate hacker associations, but the names that Russian researchers gave them in their reviews of techniques and tactics.

To somehow determine the visibility of the group, we used the Yandex Wordstat^[2] service]. It provides statistics on the requests of users that they type in the Yandex search engine. The use of group names in a search query indicates some fame of a particular group, so the number of search queries typed by users for a particular group was regarded by us as an indicator of its fame.

However, for some groups, this method of determining the popularity index does not work. This refers to the names of groups that match popular names such as Lazarus or Sauron. In this case, I had to use my own expert assessment of the level of popularity. So the popularity index is, rather, a synthetic indicator that characterizes the fame of a particular group, and not its "merit."

Attack on the country in cinema and in life

Netflix in February 2025 released a mini-series called Zero Day, which attempted to simulate the situation of an unprecedented attack on critical US infrastructure. The authors relied heavily on examples from life, but also did not do without obvious exaggerations. TAdviser spoke with cybersecurity experts and traced the parallels between the plot of the series and reality, and also assessed how the built model of a large-scale cyber attack can be implemented in reality.

Together with TAdviser, the series was watched and discussed in podcast format:

• Gennady Sazonov, Head of Incident Investigation at Solar 4Rays Center, Solar Group of Companies
• Evgeny Chunikhin, Business Head of Cyber ​ ​ Intelligence at F6

Watch the podcast on VK Video and in Rutube.

A text overview is available from the link.

2024

A new hacker group GoldenJackal has been identified, attacking government agencies isolated from the Internet

In early October 2024, researchers cyber security ESET discovered new tools used by the hacker group GoldenJackal against governmental and diplomatic institutions in the To Europe Middle East and South. Asia More here

A new cyber group has been identified that uses 500,000 domains to attack companies around the world

On July 17, 2024, Infoblox specialists announced the identification of the Revolver Rabbit cyber group, which registered more than 500 thousand domain names for information theft campaigns. Attackers attack systems running Windows and macOS. Read more here

2023: Israeli hacker group that influenced elections around the world revealed

In mid-February 2023, it became known about the Israeli hacker group Team Jorge, which manipulated more than 30 elections around the world using cyber attacks, sabotage and automated disinformation on social networks. The group is led by former Israeli intelligence officer Tal Hanan. Read more here.

2020: North Korea hacker group Kimsuky attacks Russian military-industrial complex enterprises

On October 19, 2020, it became known about hacker attacks on military and industrial enterprises in. Russia A North Korean group of cybercriminals Kimsuky conducted malicious mailings in the spring, including through social networks, to obtain confidential information from aerospace and defense companies, Anastasia To the businessman Group-IB Tikhonova, head of the complex threats research department, said. More. here

See also

Notes