Loading threat actor…
хакерскии_кiт is a pro-Ukrainian hacktivist threat actor associated with disruptive and extortion-linked intrusions, primarily against Russian organizations, and observed in overlapping operations with groups including C.A.S., 4BID, and Goffee. Public reporting tied the group to a claimed attack on a Russian factory where ClearWater ransomware was deployed, with explicit acknowledgment of assistance from C.A.S., indicating at least episodic cooperation among related actors. The actor has been observed in campaigns targeting organizations in Russia and, within a broader cluster of related activity, victim environments in Kazakhstan, Egypt, the United Arab Emirates, Syria, and Belarus. Reported victim sectors for the cluster include government, healthcare, and aviation. The operational pattern commonly begins with exploitation of Microsoft Exchange ProxyShell vulnerabilities, followed by deployment of an ASP.NET web shell for command execution, file transfer, and reconnaissance. Post-compromise activity includes PowerShell and batch-script execution, installation of legitimate remote-management and monitoring tools for persistence and remote access, and use of multiple post-exploitation frameworks and malware families. Tooling associated with the broader activity cluster includes dual-use remote administration software, Sliver, Havoc, Mythic Apollo, AdaptixC2, the BlackSalt backdoor, ClearWater ransomware, and updated Blackout Locker samples. The actors also used defense-evasion tooling based on bring-your-own-vulnerable-driver techniques to disable security products. ClearWater ransomware encrypted files, dropped ransom notes, altered desktop presentation, and deleted recovery artifacts, while related campaigns also used ransomware with persistent screen-locking behavior. The group’s activity is consistent with a shift from purely ideological hacktivism toward financially motivated operations. High-confidence reporting links хакерскии_кiт to ransomware-enabled attacks against Russian targets and to cooperation with adjacent pro-Ukrainian hacktivist actors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
61 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist group observed in the same victim networks as 4BID; linked in the report to ClearWater ransomware activity and possible joint operations or ties with other groups.
Проукраинская хактивистская группа, публично заявившая об атаке на российский завод; в связанной инфраструктуре был обнаружен шифровальщик ClearWater. Упоминается как одна из групп, чья активность пересекается с другими участниками кампаний.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.