Loading story…
A Ukrainian hacker group identified as CyberJunta/CyberHunta published more than 2,300 emails and documents it said were taken from the mailbox of Vladislav Surkov, a senior aide to Russian President Vladimir Putin. The leaked cache reportedly included email exchanges, passport scans of Surkov and his family, and documents describing efforts to influence Ukrainian politics, support nationalist and separatist figures, and push for early parliamentary elections. A later tranche of material also allegedly outlined a 2015 plan to destabilize Kharkiv and showed attempts to use influence over Ukrainian politicians to introduce legislation in Kyiv.
The disclosures were treated as at least partly credible by several reviewers, with Ukraine’s SBU saying the files appeared authentic and Digital Forensic Research Lab analyst Aric Toler reportedly finding the Outlook data likely genuine after checking headers and matching contents to real events, though both cautioned some released documents may have been altered after exfiltration. The Kremlin rejected the allegations and denied the authenticity of the material, with spokesman Dmitry Peskov saying Surkov did not use email and dismissing claims that he was involved in any destabilization campaign in Ukraine.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
By early November 2016, reporting described a newly disclosed cache of hacked emails allegedly from Surkov's office that pointed to a 2015 plan to destabilize Kharkiv in eastern Ukraine. The material also allegedly showed Russian influence being used to get legislation introduced in Ukraine's parliament.
After the leak became public, Kremlin spokesman Dmitry Peskov rejected the authenticity of the documents and denied Surkov's involvement in any destabilization plot described in them. Russian officials also argued that Surkov did not use email, disputing the premise of the hack.
Following the publication of the leak, Ukraine's SBU said experts believed the released documents appeared authentic, while cautioning that some files could have been altered after exfiltration. Independent analysis cited by media, including DFRLab review of headers and corroboration with real-world events, also judged at least part of the cache likely genuine.
On 2016-10-25, a Ukrainian hacker group variously identified as CyberJunta/CyberHunta claimed it had hacked Kremlin aide Vladislav Surkov and released more than 2,330 emails and related documents. The leaked material reportedly included correspondence, planning documents, and passport scans tied to Surkov and his family.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
web.archive.org
Open sourcetheguardian.com
Open sourcesmh.com.au
Open sourcerferl.org
Open sourceweb.archive.org
Open sourceru.bellingcat.com
Open sourceforeignpolicy.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian government-linked hackers penetrated the Democratic National Committee, stole opposition research on Donald Trump and thousands of internal emails, and triggered a wider investigation after leaked material exposed not only politically damaging correspondence but also sensitive donor and personal data. Security firms including CrowdStrike, Mandiant, Fidelis, SecureWorks, and ThreatConnect tied the intrusion to Russian groups tracked as `APT28`/**Fancy Bear** and `APT29`, with later reporting pointing specifically to Russia’s military intelligence service, the **GRU**, based on malware and infrastructure overlaps. Researchers and investigators said the operation combined network intrusion, theft, and staged disclosure in a manner consistent with a coordinated influence campaign targeting the 2016 U.S. election. After the breach became public, the online persona **Guccifer 2.0** surfaced to claim responsibility and deny Russian involvement, but reporting and forensic analysis described the persona as a likely cutout used to distribute stolen documents and muddy attribution. WikiLeaks then published large batches of DNC emails while later reports said it had direct outreach to Donald Trump Jr. during the campaign and declined to publish a separate cache of Russian government documents in the same period, intensifying scrutiny of its role in the broader information operation. Subsequent congressional and special-counsel-era reporting found sharp partisan disagreement over whether Trump associates coordinated with Russia, but broad agreement that Moscow conducted an interference campaign that used hacked Democratic materials to damage Hillary Clinton and influence the election.
Jun 29, 2026
Ukrainian officials warned that Russia-linked hackers are revisiting earlier compromises to regain access to government and defense networks, testing whether old footholds, unpatched vulnerabilities, and previously stolen credentials still work. CERT-UA said the activity reflects a broader shift from smash-and-grab credential theft toward persistent access, with initial intrusion methods also evolving beyond phishing to more tailored social engineering, including phone calls and video chats in fluent Ukrainian before malicious files are delivered through messaging apps. Agencies tied the activity to groups including **APT28** and **Void Blizzard**, with the security and defense sector remaining the top target because disruptions there could affect the war effort. Ukraine also confirmed a long-running cyber-espionage campaign, tracked since 2023 and attributed by Western researchers to **APT28** (`Fancy Bear`, `BlueDelta`, `Forest Blizzard`), that targeted prosecutors, anti-corruption bodies, and other local government entities through **Roundcube** webmail vulnerabilities enabling code execution when a victim opened an email. Reuters reported that more than 170 email accounts belonging to prosecutors and investigators were compromised in recent months, and CERT-UA identified three waves of related attacks. Officials said some allegedly stolen material was later published online, though reviews indicated the leaks likely did not include confidential data, and warned the operation could still be used to fuel disinformation aimed at eroding trust in Ukrainian institutions.
Jun 29, 2026
Ukraine’s Security Service (**SSU**) publicly identified five alleged members of the **Gamaredon** cyber-espionage group and said the operators worked from Sevastopol, Crimea, under the direction of Russia’s **FSB Center 18**. The SSU said it issued high-treason notices and released intercepted calls to support its claims, marking a rare public attribution of the group to a named Russian security service. Ukrainian authorities said Gamaredon had operated since 2013 and carried out more than **5,000 cyberattacks** against over **1,500** Ukrainian government systems, focusing on intelligence collection from security, defense, and law-enforcement bodies. Reporting and threat tracking describe Gamaredon—also known as **Armageddon**, **Shuckworm**, **Primitive Bear**, **Trident Ursa**, **ACTINIUM**, **DEV-0586**, and **UAC-0010**—as a long-running Russian espionage actor that primarily targets Ukrainian state entities, with some activity extending to European institutions. The group is known for spearphishing and spoofed emails carrying malicious Office documents, macros, VBScript, PowerShell, and batch files, along with malware such as **Pterodo/Pteranodon**, **GammaLoad**, **GammaDrop**, **GammaSteel**, and **QuietSieve**. Analysts also link the actor to evasive infrastructure including dynamic DNS, fast-flux hosting, dead-drop resolvers, and Telegram- or GitHub-linked delivery and control mechanisms, as well as data theft, screenshot capture, remote access, and destructive actions such as file wiping and desktop defacement.
Aug 15, 2026