{
	"id": "a0c77d62-6637-4828-b3b5-74ad6bf3618b",
	"created_at": "2026-04-06T00:19:59.924777Z",
	"updated_at": "2026-04-10T03:30:58.758459Z",
	"deleted_at": null,
	"sha1_hash": "17e08991168736fd5fb5f485790468c22ced207c",
	"title": "The increasing presence of pro-Russia hacktivists",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 33303,
	"plain_text": "The increasing presence of pro-Russia hacktivists\r\nBy Tom Raynel\r\nPublished: 2023-02-27 · Archived: 2026-04-05 16:03:09 UTC\r\nA new advisory report released by Radware, a global leader of cyber security and application delivery solutions\r\nfor physical, cloud, and software-defined data centres, has highlighted a pro-Russian hacktivist group called\r\nZarya.\r\nThe group, which operated initially as a special force's unit under Killnet, is building Mirai variants to increase the\r\nattack power of the DDoS botnet it uses to perform attacks on the West. \r\nZarya's propaganda website, known as 'Zarya - CyberFront,' and its attack campaign log and malware is hosted by\r\nAkur Group, a hosting provider for pro-Russian hacktivist groups. \r\nWith the Russian/Ukrainian conflict now in its second year, this recent activity is significant because it\r\ndemonstrates how pro-Russian hacktivists have evolved their tools, techniques, and procedures over time.\r\nPro-Russian hacktivists have moved beyond the basic denial-of-service scripts and crowdsourced attacks to more\r\nadvanced and potent techniques. This even means leveraging and cooperating with other hacktivist groups within\r\nthe Russian-speaking community to achieve their goals.\r\nThe digital threat actors involved have become more organized and sophisticated. In addition, social communities\r\nhave emerged supporting these malicious activities through social media and online groups on various platforms.\r\nThis growing influence has resulted in a proliferation of malicious activities and the spread of sophisticated tools\r\nand techniques across the internet. Not only this, but even the support of criminal activities such as buying and\r\nselling stolen data or hosting malware used in cyber-attacks. \r\nZarya - who are they?\r\nZarya, which translates to \"dawn,\" is a pro-Russian hacktivist group that emerged in March 2022. Initially, the\r\ngroup operated as a special forces unit under the command of Killnet.\r\nZarya's objectives have evolved as the conflict between Russia and Ukraine has progressed. This led to a\r\nbreakaway from Killnet, with the group at times going by 0x000000.\r\nIt led to a focus on recruiting skilled hackers from other pro-Russian threat groups that were burning out in the\r\nspring of 2022.\r\nIn May 2022, Zarya rejoined Killnet as part of a larger project, translated as, 'Legion.' During the summer of 2022,\r\nthe group, Zarya Legion, established itself as a leading force, setting an example for other groups and eventually\r\nbecoming an independent entity known as just Zarya in August 2022.\r\nhttps://channellife.com.au/story/the-increasing-presence-of-pro-russia-hacktivists\r\nPage 1 of 2\n\nAs for what Zarya does, the group is primarily known for its involvement in Denial-of-Service attacks, website\r\ndefacement campaigns, and data leaks. \r\nThese operations have been leveraged to support the group's pro-Russian agenda and have significantly disrupted\r\ntargeted organizations and individuals who wish to threaten Russia's position geopolitically.\r\nZarya's CyberFront website provides information about targets for the pro-Russian hacktivist group. According to\r\nthe website, the group primarily targets government agencies, service providers, critical infrastructure, and civil\r\nservice employees almost entirely internationally.\r\nThe website currently features links to 48 different hacking campaigns carried out by the group, along with the\r\ncorresponding leaked data. Allegedly, 655 Gigabytes worth of data has been leaked, which is a very serious\r\nrevelation considering the security implications of such a large leak.\r\nSource: https://channellife.com.au/story/the-increasing-presence-of-pro-russia-hacktivists\r\nhttps://channellife.com.au/story/the-increasing-presence-of-pro-russia-hacktivists\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"references": [
		"https://channellife.com.au/story/the-increasing-presence-of-pro-russia-hacktivists"
	],
	"report_names": [
		"the-increasing-presence-of-pro-russia-hacktivists"
	],
	"threat_actors": [
		{
			"id": "76d871c3-96cd-41d3-8889-f0396e480e91",
			"created_at": "2023-11-14T02:00:07.093421Z",
			"updated_at": "2026-04-10T02:00:03.449641Z",
			"deleted_at": null,
			"main_name": "Zarya",
			"aliases": [
				"UAC-0109"
			],
			"source_name": "MISPGALAXY:Zarya",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "b4a6d558-3cba-499c-b58a-f15d65b7a604",
			"created_at": "2023-01-06T13:46:39.346924Z",
			"updated_at": "2026-04-10T02:00:03.295317Z",
			"deleted_at": null,
			"main_name": "Killnet",
			"aliases": [],
			"source_name": "MISPGALAXY:Killnet",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434799,
	"ts_updated_at": 1775791858,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/17e08991168736fd5fb5f485790468c22ced207c.pdf",
		"text": "https://archive.orkl.eu/17e08991168736fd5fb5f485790468c22ced207c.txt",
		"img": "https://archive.orkl.eu/17e08991168736fd5fb5f485790468c22ced207c.jpg"
	}
}