Kaspersky Links Gorilla RAT and Monkey Ransomware to Hacking Cat Attacks on Russian Targets
Summary
Kaspersky linked Gorilla RAT and Monkey Ransomware to attacks attributed to pro-Ukraine group Hacking Cat, noting shared tools complicate attribution. The group disputes some of the attribution.
Key points
- Kaspersky says Hacking Cat shifted toward attacks designed to encrypt or destroy data on Russian targets by summer 2025.
- Some attacks reportedly exploited Microsoft Exchange vulnerabilities to gain access before deploying Gorilla RAT, which can tunnel network traffic for remote access.
- Researchers found multiple Monkey Ransomware variants, which encrypt data and add the “.monkey” extension; Kaspersky said rapid development may reflect AI use or experimentation.
- Kaspersky observed multiple hacktivist groups using shared tools and, in some cases, identical multi-stage infection chains, complicating attribution.
- Kaspersky linked Hacking Cat and other Ukraine-linked groups to destructive attacks, including one using Nemo Wiper, which researchers said appears designed to destroy data and disrupt infrastructure.
- Hacking Cat disputed Kaspersky’s attribution of some tools, saying certain lockers were not its own.
Article Details
- Event Type
- Researchers reported that pro-Ukraine hacktivist group Hacking Cat has shifted to destructive attacks against Russian targets, using Gorilla RAT and Monkey Ransomware in intrusions linked to the group.
- Impact
- Reported attacks include encryption or destruction of data and disruption of infrastructure. Some intrusions reportedly exploited Microsoft Exchange vulnerabilities for initial access before deploying Gorilla RAT, which can tunnel network traffic for remote access. Kaspersky said shared tools and infection chains complicate attribution; Hacking Cat disputed attribution of some malware.
Threat Actors
Cyber Anarchy SquadPro-Ukraine hacktivist group that claimed responsibility with Hacking Cat for breaching a Rosatom contractor.Hacking CatPro-Ukraine hacktivist group linked by Kaspersky to attacks against Russian targets; the group disputed attribution of some malware.Ukrainian Cyber AllianceHacktivist group that worked with Hacking Cat on a destructive attack against Donbassteploenergo and a joint operation using Nemo Wiper.
Malware
Gorilla RATResearchers say the pro-Ukraine hacktivist group Hacking Cat has moved from defacements and leaks to more destructive attacks on Russian targets, using custom tools like Gorilla RAT and Monkey Ransomware.Monkey RansomwareResearchers say the pro-Ukraine hacktivist group Hacking Cat has moved from defacements and leaks to more destructive attacks on Russian targets, using custom tools like Gorilla RAT and Monkey Ransomware.Nemo WiperFor example, during a joint operation with the Ukrainian Cyber Alliance, the hackers used malware called Nemo Wiper.
Vendors
Products
Countries
RussiaIn March, Hacking Cat and another pro-Ukraine hacktivist group, Cyber Anarchy Squad, claimed responsibility for breaching a contractor working for Rosatom, Russia’s state nuclear energy corporation.UkraineResearchers say the pro-Ukraine hacktivist group Hacking Cat has moved from defacements and leaks to more destructive attacks on Russian targets, using custom tools like Gorilla RAT and Monkey Ransomware.
Industries
EnergyIn March, Hacking Cat and another pro-Ukraine hacktivist group, Cyber Anarchy Squad, claimed responsibility for breaching a contractor working for Rosatom, Russia’s state nuclear energy corporation.Nuclear energyIn March, Hacking Cat and another pro-Ukraine hacktivist group, Cyber Anarchy Squad, claimed responsibility for breaching a contractor working for Rosatom, Russia’s state nuclear energy corporation.