Two new pro-Russian hacktivist teams have emerged in current months to mount cyberattacks on Ukraine and its allies.
The teams, calling themselves IT Military of Russia and TwoNet, use the Telegram messaging app to coordinate operations, recruit insiders and acquire details about targets in Ukraine, in accordance with a brand new report by cybersecurity agency Intel 471.
Researchers mentioned each teams appeared earlier this yr and could also be rebrands of beforehand recognized risk actors, although their actual hyperlinks to previous campaigns stay unclear.
Like different well-known Russian hacktivist teams — together with NoName057(16), KillNet and XakNet Group — the brand new gangs are primarily finishing up distributed denial-of-service (DDoS) assaults, web site defacements and knowledge theft.
The IT Military of Russia first appeared in late March 2025 and communicates by way of the Obligation-Free cybercrime discussion board and a Telegram channel with over 800 subscribers, Intel 471 mentioned.
The group posts about alleged assaults on Ukrainian web sites, leaks stolen knowledge and recruits insiders working in Ukraine’s crucial infrastructure. A lot of its targets have been small Ukrainian companies, the report mentioned.
The group additionally operates a Telegram bot that encourages customers to submit intelligence about Ukraine’s army or infrastructure and to recommend new targets for cyberattacks. It reportedly makes use of a device known as PanicBotnet, marketed on underground boards, to launch DDoS operations.
Most lately, the group posted on its channel what it claimed have been leaked databases from a number of Ukrainian and Polish web sites, together with a Ukrainian actual property search platform, a make-up retailer, and Poland’s instructional platform, Intel 471 mentioned.
The second group, TwoNet, surfaced in January 2025 and is believed to have round 40 members concerned in hacking, software program improvement and open-source intelligence gathering. The group’s most popular tactic can be DDoS incidents, and its Telegram channel has promoted assaults on authorities and infrastructure targets in Ukraine, Spain and the U.Ok., Intel 471 mentioned.
Researchers say the group has claimed partnerships with different pro-Russian actors. In January, TwoNet’s Telegram channel introduced the dying of 1 alleged member, nicknamed “Sakura,” reportedly killed throughout fight in Ukraine.
Because the begin of the warfare, a number of Russian hacking teams have modified their techniques, instruments and, in some instances, identities. KillNet, as soon as known for its high-profile pro-Kremlin hacktivist campaigns, has lately resurfaced with a deal with cybercrime-for-hire operations, prioritizing revenue and popularity over political messaging.
Different teams, such because the Cyber Military of Russia Reborn — whose members have been sanctioned by the USA final yr — have largely disappeared from public view, whereas one of the crucial prolific hacktivist collectives, NoName057(16), continues its operations, concentrating on a minimum of one or two entities every week.
Recorded Future
Intelligence Cloud.
