IT Army of Ukraine
The IT Army of Ukraine is a pro-Ukraine volunteer hacktivist and cyberwarfare collective formed in late February 2022 after Russia’s invasion of Ukraine. It was publicly announced by Ukraine’s Minister of Digital Transformation, Mykhailo Fedorov, and coordinates volunteers primarily through Telegram and Twitter. The group is described as dividing participants into offensive and defensive cyber units, with volunteers ranging from regular computer users to more advanced operators. The content consistently associates the IT Army of Ukraine with distributed denial-of-service (DDoS) operations against Russian and Belarusian targets, including Russian banks, internet service providers, government websites, telecoms, and other infrastructure. Reported or claimed targets mentioned in the content include Akado, GazpromBank, the Moscow Stock Exchange, Sberbank, Roscosmos, the FSB, Russian and Belarusian government sites, and Russian digital-signature issuers including Osnovanie. The group was also reported as having targeted Yandex Taxi in collaboration with Anonymous, causing a traffic disruption in Moscow. The content further states that the group listed Kaluga Astral among its intended targets in 2023, although there is no evidence linking it to Astral’s later incident and it is unclear whether it ever successfully attacked the company. The group is described as lowering the barrier to participation by publishing target lists and providing tooling through itarmy.com.ua, including the “IT Army Kit,” improved versions of MHDDOS, DB1000N, and Distress, and an Automatic DDoS Server Starter (ADSS) for Linux systems. The tooling reportedly supports graphical configuration, automated target-list updates, scheduling, and automatic updates. The group also maintained a leaderboard and anonymous IT Army IDs via Telegram to incentivize volunteers. The content states that guidance was published for deploying attack infrastructure and abusing free cloud trials from providers including Google Cloud, Amazon, Azure, Hetzner, and Digital Ocean. The content portrays the IT Army of Ukraine as part of the broader cyber dimension of the Russia-Ukraine war and notes overlap or cooperation with Ukrainian state structures in some reporting. One cited passage states that Ukraine’s defense intelligence directorate (GUR) teamed with the crowdsourced IT Army of Ukraine to conduct DDoS attacks against Russian civilian targets including banks and ISPs. Another source notes that the group later stated it would abide by International Committee of the Red Cross rules of engagement for civilian hackers. The content also notes that the group denied knowing whether Artyom Khoroshilov was part of its community. Known alias in the provided content: it_army_of_ukraine.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
- Government & Administration
- Banks
Where they target
Geographies tied to known operations.
- 🇷🇺 Russia
Where they're from
Attributed origin per open-source reporting.
- UA
Tradecraft
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Volunteer hacktivist collective that publicly listed Kaluga Astral as an intended target in 2023; the content does not establish that it carried out the latest attack.
The IT Army of Ukraine is a hacktivist group coordinating distributed denial-of-service (DDoS) attacks on Russian infrastructure, particularly during the Russia-Ukraine conflict.
Coordinating distributed denial-of-service (DDoS) attacks on Russian infrastructure, particularly since the start of the war between Russia and Ukraine.
Large crowdsourced volunteer hacktivist collective aligned with Ukraine; used to conduct DDoS operations against Russian civilian and dual-use targets, reportedly in coordination with GUR.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.