Ukraine Invasion Fuels Hacktivist Attacks and Darknet Data Leaks
Summary
DarkOwl’s February–April 2022 timeline tracks invasion-related cyberattacks, Russian data leaks, ransomware-group divisions and infrastructure warnings. Many hacktivist claims remain unverified, and some purported leaks contain older data.
Key points
- DDoSecrets published 222GB of Gazregion emails and corporate files submitted by Anonymous, nb65 and DepaixPorteur, according to the April 18 update.
- nb65 claimed it encrypted Russian bank JSC PSCB’s network with a modified Conti ransomware variant, stole over 1TB of financial and client data, and deleted backups.
- Continent Express acknowledged a cyberattack but said important data and booking systems were unaffected; DDoSecrets subsequently distributed over 400GB attributed to the attack, with leak details unconfirmed.
- DDoSecrets released approximately 1.97 million emails totaling 2TB from five Russian government and corporate organizations over three days in April.
- An April 13 joint US advisory warned of capabilities to compromise industrial control systems, including Schneider Electric and OMRON controllers and OPC UA servers.
- Conti’s support for Russia prompted internal divisions and leaks of private chats, infrastructure details and ransomware executables; the group later revised its public position.
- DarkOwl cautioned that some claimed breaches lacked corroboration or recycled older data. It also flagged a purported Russian propaganda directive as potentially fabricated after researchers identified signature mismatches.
Article Details
- Event Type
- Conflict-related cyberattacks, hacktivist operations, and data leaks
- Impact
- The article reports widespread data exposure and operational disruption following Russia’s invasion of Ukraine, including ransomware, destructive attacks, DDoS, account compromises, and information operations. Reported effects include leaked corporate and government emails, exposed personal information, disrupted aviation and railway operations, and attacks against industrial control systems. Rosaviatsiya reportedly lost 65TB of data and resorted to paper-based operations. Many attack claims and leaked datasets remained unverified; Continent Express acknowledged an attack but said important data and booking systems were unaffected, and the Ukrainian Red Cross reported no compromise of beneficiary personal data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | alfa-finrase[.]com | Identified as a cryptocurrency scam website and store trading fraudulent identity data; KelvinSec claimed to have exploited it and exposed customer data. |
MITRE ATT&CK
T1114 · Email CollectionHacktivists reportedly collected corporate and government email archives for public disclosure.T1190 · Exploit Public-Facing ApplicationAnonymous Liberland and the Pwn-Bär Hack Team said they breached Tetraedr through an unpatched ProxyLogon vulnerability.T1195.001 · Compromise Software Dependencies and Development ToolsAgainstTheWest referenced a software dependency supply-chain attack involving a poisoned burgeon-r3 NPM package; the claim was not independently confirmed.T1485 · Data DestructionThe article reports destructive deletion of files and databases, including the alleged erasure of 65TB at Rosaviatsiya.T1486 · Data Encrypted for Impactnb65 claimed to encrypt Russian organizations’ networks using its version of CONTI ransomware.T1490 · Inhibit System Recoverynb65 and GhostSec claimed to delete backups to prevent recovery after attacks.T1491.001 · Internal DefacementAnonGhost reportedly changed an industrial networking device’s name, description, and login message; other groups reported defacing compromised account profiles.T1491.002 · External DefacementAnonymous members reportedly defaced the website of the Space Research Institute and security camera displays.T1498 · Network Denial of ServiceReported DDoS operations targeted government websites and other online services, including Finnish military, defense, and foreign affairs webservers.
People
Igor RudenyaGovernor whose email system was reportedly the source of more than 130,000 emails leaked after an Anonymous-linked compromise.Jonathan ScottIdentified as a mobile spyware and IoT malware researcher whom the operator of an nB65 social media account claimed to be; the article does not verify that identity claim.Oleksandr KamyshinDirector of Ukrzaliznytsya quoted confirming that railway connections between Ukraine and Belarus had stopped, while declining to discuss operational details.
Threat Actors
AgainstTheWestAlso identified as ATW and Blue Hornet; claimed attacks and leaks involving Russian and Chinese organizations. The article repeatedly notes verification limitations.AnonGhostClaimed industrial control system attacks against Russian infrastructure, including street lighting, and published evidence of access to industrial networking devices.AnonymousHacktivist collective associated with numerous reported attacks, data leaks, defacements, and information operations against Russian targets.Anonymous LiberlandAlongside the Pwn-Bär Hack Team, announced a leak of approximately 200GB of Tetraedr employee correspondence and claimed exploitation of an unpatched ProxyLogon vulnerability.Arvin ClubRansomware group reported to have compromised STORMOUS’s Tor service and leaked its databases.BeeHive CybersecurityClaimed compromises of more than 2,700 pro-Russian Discord accounts and ransomware operations against Russian targets.Blue HornetExplicitly identified with AgainstTheWest; its claimed state sponsorship and several attack claims could not be verified.ContiRansomware group whose internal communications and operational infrastructure were leaked after its support for Russia; also claimed responsibility for the Nordex attack.Cyber PartisansReportedly disrupted Belarusian railway ticketing and switching systems to impede railway operations.devilix-EUPro-Russian persona claiming cloud and server compromises, BGP hijacking, and a custom ransomware named DEVILIX shark.GhostSecReported data theft, destructive activity, printer compromises, and industrial control system attacks; the article also uses the name Ghost Security.KelvinSecReportedly compromised Nestle, DATABASE Market, and a cryptocurrency scam website, publishing stolen data.KillnetPro-Russian group reported to have claimed attacks against Polish government and financial networks, CYBERPOL, and an airport ticketing system.Network Battalion (nb65)Also explicitly called Network Battalion 65; claimed ransomware attacks and data theft against Russian organizations using a modified CONTI variant.Pwn-Bär Hack TeamAlongside Anonymous Liberland, claimed the Tetraedr breach and released employee email archives.spectre123Threat actor reported to have released more than 40GB of purported Indian government and military data; the article describes the documents as classified but provides no independent verification.StormousRansomware group that declared support for Russia and claimed attacks against Ukrainian government and airline targets.VaticanoRaid Forums threat actor whom DarkOwl analysts believed operated the Free Civilian Tor service distributing Ukrainian government databases.XakNet TeamPro-Russian group that threatened attacks against critical information infrastructure.
Malware
AntiwarAnother ransomware variant recently detected, known as “Antiwar” appends the file extension, “putinwillburninhell” to encrypted files.BazarLoaderAnalysis confirms that the gang uses BazarLoader backdoor for installing persistent malware on infected machines.Continb65 posted to social media they compromised SSK Gazregion on April 3rd with their version of CONTI ransomware.DEVILIX sharkThe group makes further claims that they’re named after their own custom ransomware, “DEVILIX shark.”RURansomAccording to Trend Micro, RURansom was detected targeting Russian-specific devices with AES-CBC encryption and hard coded salt.STORMOUSArvin Club Takes Down STORMOUS Ransomware’s Tor Onion Service
Vendors
Carbon BlackDarkOwl analysts also noted from leaked Jabber messages that RaaS affiliates were persistent at determining how to evade AV/EDR protection systems like Sophos and Carbon Black.HuaweiChina’s Huawei Steps in to Assist Russia with ISP Network InstabilityMoxaAnonGhost Claims to Hack Russian Street Lighting System and Drops Proofs of Access to Moxa Industrial Wireless Networking InfrastructureNaumenAnonymous Targets Russian Software Developer, naumen.ruOMRONOMRON Sysmac NEX PLCs; andSchneider ElectricSchneider Electric programmable logic controllers (PLCs);SITAof Russia will have additional impacts to their IT support with the withdrawl of the Swiss-based company, SITA as of 29 March.SophosDarkOwl analysts also noted from leaked Jabber messages that RaaS affiliates were persistent at determining how to evade AV/EDR protection systems like Sophos and Carbon Black.
Products
Alibaba CloudAfter ATW attacked Alibaba Cloud days before, Ghost Security has allegedly hacked and deleted Alibaba’s UAE branch’s ElasticSearch service database.DiscordAnonymous Takes Over Pro-Russian Discord AccountsGoogle ChromeThe hacktivists further taunted the bank stating how grateful they were the stored so many credentials in Chrome – a browser for which several emergency security patches have been recently released.iviAnonymous Continues Information Warfare Against Russian Media; Video Services Wink and ivi Stream Anti-War MessagingOMRON Sysmac NEX PLCsOMRON Sysmac NEX PLCs; andSITA Passenger Service Systemday as the invasion of Ukraine, resulting in the compromise of passenger data stored on their SITA Passenger Service System (US) Inc.VKin a main gas pipeline “Urengoy-Center-2” that civilians captured on Russian social media platform, VK as a large fire occurred in the Lysvensky district of the Kama region near the village of Matveevo.WinkAnonymous Continues Information Warfare Against Russian Media; Video Services Wink and ivi Stream Anti-War Messaging
Countries
Belarus“direct instructions to infiltrate, attack and leak the country of China, Russia, Iran, North Korea & Belarus.” The group’s Twitter account was also blocked by Russia’s Kremlin account earlier this week and theChinaa “state-sponsored” cyber group with “direct instructions to infiltrate, attack and leak the country of China, Russia, Iran, North Korea & Belarus.” The group’s Twitter account was also blocked by Russia’s KremlinFinlandFinland Suffers Cyberattack; Announces They Will Expedite Application for NATO MembershipGermanyOn the 31st of March, Nordex wind turbine manufacturing company in Germany suffered a significant cyberattack.Indiagovernment documents from the following sectors: ALISDA, DGAQA, MSQAA, DRDO, DDP, Joint Defence Secretary India, BSF, MOD and the Indian Navy.Irancyber group with “direct instructions to infiltrate, attack and leak the country of China, Russia, Iran, North Korea & Belarus.” The group’s Twitter account was also blocked by Russia’s Kremlin account earlierNorth Koreagroup with “direct instructions to infiltrate, attack and leak the country of China, Russia, Iran, North Korea & Belarus.” The group’s Twitter account was also blocked by Russia’s Kremlin account earlier this weekPolandPro-Russian Killnet Launches Anonymous-Style Campaign Against Ukraine – Targets Poland and NATORussiaThe DarkOwl team are actively tracking the fallout from Russia’s invasion of Ukraine.UkraineThe DarkOwl team are actively tracking the fallout from Russia’s invasion of Ukraine.United StatesGood luck getting your data back without us.
Industries
AviationRussian Aviation Sector Suffer Additional IT Operational ImpactsDefenseOn April 8th, the Finnish government confirmed many of its military, defense, and foreign affairs webservers experienced unsophisticated, yet concerted DDoS attacks likely originating from Russian threat actors.EnergyA joint advisory issued by the Department of Energy (DOE), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) details howGovernmentFederal Bureau of Investigation (FBI) details how nation state actors (likely sponsored by the Russian government) have demonstrated the capability to gain full system access to multiple industrial control systemMedianb65 posted to social media they compromised SSK Gazregion on April 3rd with their version of CONTI ransomware.Oil and gas495,000 emails from the Russian firm Technotec, which has provided oil and gas field services along with chemical reagents used in oil production and transportation – 440GBTelecommunicationsKillnet, a Pro-Russian organized threat actor has claimed they were successful in attacking Vodafone’s telecommunications services across Ukraine.Travelnb65 Confirms Attack on Continent Express; DDoSecrets Leaks 400 GB of Russian Travel Agency’s Data