Loading threat actor…
4BID is a pro-Ukrainian hacktivist threat actor associated with intrusions against organizations in Russia and Belarus and, more recently, in Kazakhstan, the United Arab Emirates, Egypt, and Syria. Reporting also places 4BID in overlapping operational clusters with Hakerskii Kit, C.A.S., and Goffee, suggesting cooperation or shared access in some victim environments. The group has targeted government, healthcare, and aviation organizations and has shown a progression from politically framed disruptive activity toward operations that also incorporate financially motivated ransomware behavior. Observed 4BID tradecraft commonly begins with exploitation of vulnerable Microsoft Exchange servers, particularly ProxyShell, followed by deployment of an ASP.NET web shell for command execution, file transfer, and host reconnaissance. Post-compromise activity includes use of PowerShell and batch scripts to install remote-management and persistence tooling, including AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The actor has also used scripts to create hidden local accounts, enable remote access, and later remove artifacts. Tooling associated with 4BID-linked activity includes BlackReaperRAT, Sliver, Havoc, Mythic Apollo, AdaptixC2, the BlackSalt backdoor, and ransomware families including ClearWater and an updated Blackout Locker variant. BlackSalt operates as a reverse shell, while AdaptixC2 and other frameworks support command execution, file operations, process control, exfiltration, and broader post-exploitation. The actor has also employed defense-evasion tooling, including modified EDR-killer utilities and GhostDriver, using bring-your-own-vulnerable-driver techniques to terminate security products from kernel mode. Ransomware use is a notable feature of recent 4BID activity. ClearWater has been observed in compromised environments linked to the broader cluster, and 4BID has been tied to an updated Blackout Locker variant used against Russian organizations in early 2026. That variant added a persistent screen-locking component alongside file encryption, reinforcing the assessment that the group’s operations increasingly blend hacktivist objectives with extortion-oriented and financially motivated tactics.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
33 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
111 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist group whose campaigns were the primary focus of the investigation; assessed as shifting from mainly ideologically motivated attacks against Russian organizations toward financially motivated intrusions in multiple countries.
Проукраинская хактивистская группа, связанная с кампаниями против российских, белорусских, а также казахстанских, эмиратских, сирийских и египетских организаций. В исследовании ей приписываются BlackReaperRAT и использование обновленного Blackout Locker; активность указывает на расширение географии атак и возможный сдвиг от идеологической мотивации к финансовой.
Hacktivist group linked to BlackReaperRAT and updated Blackout Locker, involved in multi-country intrusions using ProxyShell exploitation, web shells, RMM tools, post-exploitation frameworks, and ransomware.
Hacktivist activity targeting organizations across Kazakhstan, the UAE, Egypt, and Syria.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.