Hacking Cat

Hacking Cat is a pro-Ukraine hacktivist group active since February 2024 that targets organizations in the Russian Federation and Russian-occupied areas of Ukraine. Its early activity included website defacements, data leaks, and publication of penetration-testing tools. From mid-2025, it shifted toward disruptive and destructive operations involving data encryption and wiping. The group has publicly collaborated with Cyber Anarchy Squad and Ukrainian Cyber Alliance; shared tooling and infection chains among these groups complicate attribution of individual intrusions. Hacking Cat-attributed activity has included exploitation of Microsoft Exchange Server vulnerabilities for initial access, deployment of Gorilla RAT for command execution, file transfer, host reconnaissance, process control, TCP tunneling, and occasional remote desktop control, and use of Monkey Ransomware against Windows, Linux, and ESXi environments. Certain Monkey Ransomware variants do not retain encryption keys, making their effects destructive rather than recoverable. Attributed ransomware variants have also included credential theft, backup and recovery inhibition, security-tool evasion, event-log clearing, and persistence mechanisms. Joint destructive activity has used Nemo Wiper to terminate enterprise services, overwrite victim data, and fill disk space. Hacking Cat has disputed ownership of some ransomware lockers attributed to it while acknowledging ownership of certain tools. Known operations include a claimed breach of a contractor supporting Russia's state nuclear-energy sector and a destructive operation against a state-owned heating provider in Russian-occupied Donetsk. The group's activity is consistent with politically motivated hacktivism supporting Ukraine rather than conventional financially motivated ransomware operations.