Loading threat actor…
Vulkangruppe is a German anarchist environmental extremist network associated with anti-technology and anti-industrial sabotage. It has been described as an extremist left-wing, insurrectionary anarchist or anarcho-primitivist milieu and has claimed attacks intended to disrupt infrastructure linked to energy consumption, industrial activity, and data-intensive technology. Public reporting ties the group to repeated sabotage operations in Germany, including attacks on power infrastructure and technology-related facilities, and indicates activity dating back to at least 2011. The group is known for targeting critical infrastructure and symbols of industrial and technological modernity. Reported targets include power lines, electricity cables, rail infrastructure, and a major electric-vehicle manufacturing site. In one prominent case, Vulkangruppe claimed responsibility for a Berlin-area power infrastructure attack that caused a large-scale outage and framed the action as resistance against the fossil fuel industry and AI-related data centre expansion. The group has also been linked in reporting to attacks on technology infrastructure more broadly, including rail networks and power systems, and to sabotage affecting Tesla’s Gigafactory in Grünheide. Vulkangruppe’s messaging reflects anti-technology, anti-industrial, and environmental extremist themes. Its statements reportedly oppose high energy consumption, global warming, and infrastructure associated with AI and large-scale computing. The group’s operational profile is consistent with sabotage and arson against critical infrastructure rather than financially motivated crime. Available reporting does not support ransomware or extortion activity. The dominant motivation is ideological, centered on destructive resistance to technological society and environmentally framed political violence.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An anarchist network conducting sabotage attacks against technology infrastructure, including power cables, rail networks, power lines, Tesla facilities, and technology parks, motivated by anti-technology and environmental extremist beliefs.
Claimed responsibility for a major power outage in southwest Berlin following a fire at a cable bridge; described as an extreme-left, anarchist environmental activist group opposing energy consumption.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.