Loading story…
Pro-Ukraine hacktivist group Hacking Cat has escalated operations against Russian organizations from website defacements and data leaks to campaigns that encrypt or destroy victim data. Kaspersky assessed with high confidence that the group uses the previously undocumented Go- and WebSocket-based Gorilla RAT, which supports command execution, file transfers, TCP tunneling, and—in some variants—VNC control; reported intrusions have at times followed exploitation of Microsoft Exchange vulnerabilities.
The activity has also been linked to cross-platform Monkey Ransomware variants targeting Windows, Linux, and ESXi, including Rust-based samples that do not preserve decryption keys and therefore operate effectively as wipers despite presenting ransom demands. Researchers observed overlaps with Ukraine-linked groups including Cyber Anarchy Squad and Ukrainian Cyber Alliance, such as ClearWater ransomware and a delivery chain for Nemo Wiper, while noting only tentative infrastructure and operational ties to Thor. Hacking Cat disputed the attribution, saying it owns certain tools but denying responsibility for the ransomware lockers.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
Monkey Ransomware emerged in late summer or early autumn 2025, with Windows-focused Rust, .NET, and C++ variants and a Go variant targeting Linux and ESXi. Some Rust versions did not retain decryption keys, making their operations effectively destructive despite ransom notes.
By summer or after mid-2025, Hacking Cat evolved from defacements and leaks toward operations intended to encrypt or destroy victim data.
Cobalt Strike infrastructure at 179.43.186[.]214 was observed in Hacking Cat-associated activity alongside Monkey Ransomware.
Hacking Cat created its Telegram channel and initially publicized website defacements, data leaks, and penetration-testing tools targeting organizations in the Russian Federation.
Hacking Cat rejected Kaspersky's attribution of some malware, acknowledging that some tools belonged to the group while denying ownership of the ransomware lockers.
Kaspersky linked the previously undocumented Gorilla RAT and numerous Monkey Ransomware variants to attacks attributed to Hacking Cat, assessing with high confidence that both toolsets were used only in the group's operations. The reporting said Exchange Server vulnerabilities were used for initial access in some incidents.
After January 2026, Hacking Cat replaced an earlier Go-based Gorilla RAT reverse shell with a more fully featured WebSocket-based remote-access tool supporting command execution, file transfers, TCP tunneling, and, in some samples, VNC control.
In a separate incident, operators used Gorilla RAT with LSAPlatformUpdate.ps1 and LSANetLogin DLLs to install a malicious Windows network provider and deliver Nemo Wiper. The chain forced Safe Mode with Networking, configured automatic administrator login, disabled USB storage and user input, and displayed a fake Windows update screen before the wiper disrupted services and overwrote data.
In a joint incident publicly acknowledged by Hacking Cat, a batch script downloaded and executed ClearWater ransomware. Hacking Cat thanked Cyber Anarchy Squad for assistance.
Hacking Cat and Ukrainian Cyber Alliance conducted a destructive attack against Donbassteploenergo, a state-owned heating provider serving Russian-occupied parts of Ukraine's Donetsk region.
Hacking Cat and Cyber Anarchy Squad claimed responsibility for breaching a contractor of Rosatom, Russia's state nuclear energy corporation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 46 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcesecurelist.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.
Jun 29, 2026
Researchers linked a cluster of hacktivist activity with medium confidence to **4BID** and associated groups including **Hakerskii Kit**, **C.A.S.**, and **Goffee**, reporting that operations have expanded beyond Russia and Belarus into **Kazakhstan, the UAE, Syria, and Egypt**. The attackers primarily obtained initial access by exploiting **ProxyShell** on vulnerable **Microsoft Exchange** servers, then installed the `fd.aspx` web shell and used custom scripts alongside legitimate remote management and monitoring tools to deepen access and persistence. Post-compromise activity included deployment of **BlackReaperRAT**, **Warp RAT**, **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, and a newly documented **BlackSalt** backdoor, as well as utilities such as **AnyDesk**, **Panorama9**, **Dev Tunnels**, **Tactical RMM**, and **Nezha Monitoring**. Investigators also observed **EDR killers**, **ClearWater ransomware**, and an updated **Blackout Locker** variant, indicating that the campaigns have evolved from primarily politically motivated disruption into broader operations with a stronger **financially motivated** component.
Jul 1, 2026
Cisco Talos reported that **BlackCat** (also tracked as **ALPHV**) shares infrastructure, tools, filenames, and intrusion tradecraft with the **BlackMatter/DarkSide** ransomware ecosystem, indicating with moderate confidence that at least one BlackMatter affiliate became an early BlackCat operator rather than the group being a simple rebrand. In side-by-side intrusions, Talos observed similar human-operated attack phases including persistent access through tunneling tools, credential theft via **LSASS** dumping, lateral movement with **Impacket `wmiexec`**, **WinRM/PowerShell**, and **RDP**, and domain-wide ransomware deployment from the domain controller’s **NETLOGON** share after scripts such as `apply.ps1`, `defender.vbs`, and `def.vbs` were staged. Talos said BlackCat dwell time exceeded 15 days in one case and noted that more than 30 percent of observed compromises affected U.S.-based organizations. Other reporting and technical analyses describe BlackCat as a **Rust-based ransomware-as-a-service** platform that emerged in late 2021, recruited affiliates from groups including **REvil, BlackMatter, and DarkSide**, and offered operators roughly **80 to 90 percent** of ransom proceeds. Researchers said the malware targets **Windows, Linux, and VMware ESXi** environments, uses double extortion with Tor-based payment portals, and includes capabilities such as **CMSTPLUA** privilege escalation, shadow-copy deletion, service and process termination, and configurable encryption using embedded keys. The overlap with DarkSide-era techniques is reinforced by prior DarkSide analyses showing similar affiliate-driven operations, extortion infrastructure, and malware behaviors, supporting the view that BlackCat grew out of the same criminal talent pool rather than appearing as an entirely separate threat.
Aug 15, 2026