Loading threat actor…
UserSec is a pro-Russian hacktivist group associated with disruptive cyber operations aligned with Russian geopolitical interests. The group has been identified among Russia-aligned hacktivist collectives considered capable of threatening high-visibility events in Europe, including the 2024 Paris Summer Olympics. Reported activity links UserSec to campaigns against Western targets, particularly in Europe and the United States, and specifically to operations supporting attacks on Swedish airport infrastructure. UserSec has been publicly associated with politically motivated disruptive activity rather than espionage or financially motivated cybercrime. Its observed behavior is consistent with Russia-aligned hacktivist tradecraft centered on denial-of-service operations and opportunistic targeting of symbolic or high-profile entities. In reporting on attacks against Sweden, UserSec was described as assisting Anonymous Sudan during a campaign against Swedish airports. The group has also been listed among pro-Russian hacktivist actors assessed as posing a viable threat to Olympic-related organizations and infrastructure. UserSec appears to operate in the broader ecosystem of pro-Russian hacktivist groups that amplify anti-Western and anti-Ukraine narratives through disruptive cyber activity. High-confidence reporting supports characterization of the group as Russia-aligned and involved in politically motivated attacks intended to create disruption and public impact, especially against transportation-related targets and Western entities.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist activity targeting US entities; conducts DDoS, defacement, and claimed database leaks.
Hacktivist group reported joining Anonymous Sudan’s DDoS campaign against Swedish airport infrastructure.
Pro-Russian hacktivist group claiming to support/assist Anonymous Sudan’s operations against Swedish airport targets.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.