Loading threat actor…
Hakerskii Kit is a hacktivist threat actor associated with a broader cluster of interconnected campaigns linked with medium confidence to groups including 4BID, C.A.S., and Goffee. The actor has been observed claiming attacks against Russian organizations and participating in operations that expanded beyond Russia and Belarus to target organizations in Kazakhstan, the United Arab Emirates, Egypt, and Syria. Activity attributed to this cluster indicates a shift from primarily politically motivated disruptive operations toward broader campaigns that also incorporate ransomware and tooling consistent with financially motivated intrusion sets. Operations associated with Hakerskii Kit relied heavily on exploitation of Microsoft Exchange ProxyShell vulnerabilities for initial access. Post-compromise activity included deployment of an ASP.NET web shell for remote command execution, file transfer, and host reconnaissance; installation of legitimate remote management and monitoring tools; use of custom scripts; and deployment of multiple post-exploitation frameworks and backdoors. Observed tooling across the associated campaigns included Sliver, Havoc, Mythic Apollo, AdaptixC2, BlackSalt, AnyDesk, Panorama9, Tactical RMM, Dev Tunnels, and Nezha Monitoring. The actor cluster demonstrated broad post-exploitation capability, including command execution, persistence through local account creation and remote access enablement, reconnaissance, exfiltration, process control, and defense evasion. Defense evasion included use of modified and open-source EDR-killing utilities that abused vulnerable drivers to terminate security products from kernel mode. Ransomware-linked activity was also observed in compromised environments, including ClearWater ransomware and an updated Blackout Locker variant. These operations indicate that Hakerskii Kit is part of an evolving ecosystem of hacktivist-branded actors whose campaigns blend ideological targeting with increasingly mature intrusion tradecraft and extortion-enabling tooling.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
111 indicators attributed to this actor. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.