Loading threat actor…
Hacking Cat is a pro-Ukraine hacktivist group active since approximately February 2024, principally targeting organizations in the Russian Federation. Its early activity included website defacements, publication of stolen documents, and promotion of pro-Ukraine messaging. From mid-2025, it was associated with more disruptive operations intended to encrypt or destroy victim data. The group has reportedly collaborated with Cyber Anarchy Squad and Ukrainian Cyber Alliance; shared tooling and infection chains among these collectives complicate attribution of individual operations. Hacking Cat has been associated with exploitation of Microsoft Exchange Server vulnerabilities for initial access and with Gorilla RAT, a Go-based remote-access tool supporting command execution, system and process discovery, file transfer, TCP tunneling, and in some variants remote desktop control. Gorilla RAT includes anti-analysis checks and supports Windows persistence. Operations attributed to the group have also involved Monkey Ransomware variants targeting Windows, Linux, and VMware ESXi. These variants impair recovery mechanisms and encrypt files; certain variants reportedly do not preserve decryption material, making their effects destructive despite ransom-note behavior. Related operations have included ClearWater ransomware and Nemo Wiper, the latter designed to overwrite data and impede recovery. The group has claimed attacks affecting a contractor connected to Russia's state nuclear-energy sector and a heating provider in Russian-occupied Donetsk. Hacking Cat has acknowledged ownership of some tools attributed to it but publicly denied responsibility for ransomware variants linked to its activity.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
29 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
6 malware families Mallory has associated with this actor across public reporting.
1 additional family tracked in Mallory.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
45 indicators attributed to this actor. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.