{
	"id": "9c04b5b9-1e6f-4f2f-b769-773d2504f191",
	"created_at": "2026-04-06T00:14:32.808016Z",
	"updated_at": "2026-04-10T13:11:27.399311Z",
	"deleted_at": null,
	"sha1_hash": "6e23d1c446a1d109f68df2cfc2d3244bd8197766",
	"title": "'Cyber Berkut' Hackers Target Major Ukrainian Bank",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 42633,
	"plain_text": "'Cyber Berkut' Hackers Target Major Ukrainian Bank\r\nBy The Moscow Times\r\nPublished: 2014-07-04 · Archived: 2026-04-05 13:52:15 UTC\r\nIn an act of cyber retribution, a group of pro-Russian hackers calling themselves the Kiberberkut have obtained\r\nand published customer information stolen from one of Ukraine's largest commercial banks, PrivatBank,\r\na statement on the group's Vkontakte social network page said Friday.\r\nPrivatBank in May became a target for pro-Russian separatists in Eastern Ukraine after the bank suspended its\r\noperations in the restive cities of Donetsk and Luhansk, and its co-owner — billionaire Igor Kolomoisky – was\r\nappointed head of the nearby Dnipropetrovsk region. One of his first acts as governor of the region was to place\r\na $10,000 bounty on the heads of Russian \"saboteurs\" fighting in the region.\r\nKolomoisky even drew the notice of Russian President Vladimir Putin, who called him a \"unique imposter\" earlier\r\nthis year, Reuters reported.\r\nKolomoisky in response described the Russian president as \"a schizophrenic, short in stature.\"\r\nThe information published by Kiberberkut – or Cyber Berkut, a reference to the security forces that allegedly fired\r\non anti-Russian Maidan protesters in Kiev in February on the orders of ousted Ukrainian President Viktor\r\nYanukovych – includes such confidential information as passport data, account information and phone numbers.\r\nKiberberkut warned PrivatBank customers that their money is at risk and strongly recommended that they transfer\r\ntheir money to any state-owned bank.\r\n\"We are Kiberberkut! We will not forget! We will not forgive!\" the group said on Vkontakte.\r\nThe group explained in a statement that they had analyzed the tactics of another hacking group, Green Dragon,\r\nwho crippled PrivatBank's website on Monday with a distributed denial-of-service attack. Green Dragon claimed\r\nto have gained access to customers' account information, a statement that PrivatBank's press service denied.\r\n\"We take pride in responsibility for hacking PrivatBank owned by Kolomoisky who sponsors war campaign\r\nin Eastern Ukraine,\" Green Dragon tweeted in English on Monday.\r\nKiberberkut claims to have exposed gaps in PrivatBank's cyber security system and posted technical information\r\non their Vkontake page to prove the statement.\r\nOn Wednesday, Kiberberkut also published a list of mostly outdated customer information stolen from one\r\nof Privatbank's Russian subsidiaries – Moskomprivatbank, Gazeta.ru reported Friday.\r\nSee also:\r\nUkraine's Largest Bank Suspends Operations in Eastern Ukraine\r\nhttps://www.themoscowtimes.com/2014/07/04/cyber-berkut-hackers-target-major-ukrainian-bank-a37033\r\nPage 1 of 2\n\nA Message from The Moscow Times:\r\nDear readers,\r\nWe are facing unprecedented challenges. Russia's Prosecutor General's Office has designated The Moscow Times\r\nas an \"undesirable\" organization, criminalizing our work and putting our staff at risk of prosecution. This follows\r\nour earlier unjust labeling as a \"foreign agent.\"\r\nThese actions are direct attempts to silence independent journalism in Russia. The authorities claim our work\r\n\"discredits the decisions of the Russian leadership.\" We see things differently: we strive to provide accurate,\r\nunbiased reporting on Russia.\r\nWe, the journalists of The Moscow Times, refuse to be silenced. But to continue our work, we need your help.\r\nYour support, no matter how small, makes a world of difference. If you can, please support us monthly starting\r\nfrom just $2. It's quick to set up, and every contribution makes a significant impact.\r\nBy supporting The Moscow Times, you're defending open, independent journalism in the face of repression.\r\nThank you for standing with us.\r\n$10 / month\r\n$15 / month\r\nOther\r\nContinue\r\nNot ready to support today?\r\nRemind me later.\r\nSource: https://www.themoscowtimes.com/2014/07/04/cyber-berkut-hackers-target-major-ukrainian-bank-a37033\r\nhttps://www.themoscowtimes.com/2014/07/04/cyber-berkut-hackers-target-major-ukrainian-bank-a37033\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.themoscowtimes.com/2014/07/04/cyber-berkut-hackers-target-major-ukrainian-bank-a37033"
	],
	"report_names": [
		"cyber-berkut-hackers-target-major-ukrainian-bank-a37033"
	],
	"threat_actors": [
		{
			"id": "42a6a29d-6b98-4fd6-a742-a45a0306c7b0",
			"created_at": "2022-10-25T15:50:23.710403Z",
			"updated_at": "2026-04-10T02:00:05.281246Z",
			"deleted_at": null,
			"main_name": "Silence",
			"aliases": [
				"Whisper Spider"
			],
			"source_name": "MITRE:Silence",
			"tools": [
				"Winexe",
				"SDelete"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "afb851c4-b2e8-40e3-ac37-c55d8c0ab3cd",
			"created_at": "2022-10-25T16:07:23.516432Z",
			"updated_at": "2026-04-10T02:00:04.637109Z",
			"deleted_at": null,
			"main_name": "Cyber Berkut",
			"aliases": [
				"Kiberberkut"
			],
			"source_name": "ETDA:Cyber Berkut",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "268479f9-6666-488e-a41e-14593ed4c2f7",
			"created_at": "2023-01-06T13:46:38.614508Z",
			"updated_at": "2026-04-10T02:00:03.039929Z",
			"deleted_at": null,
			"main_name": "Cyber Berkut",
			"aliases": [],
			"source_name": "MISPGALAXY:Cyber Berkut",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "eb5915d6-49a0-464d-9e4e-e1e2d3d31bc7",
			"created_at": "2025-03-29T02:05:20.764715Z",
			"updated_at": "2026-04-10T02:00:03.851829Z",
			"deleted_at": null,
			"main_name": "GOLD WYMAN",
			"aliases": [
				"Silence "
			],
			"source_name": "Secureworks:GOLD WYMAN",
			"tools": [
				"Silence"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "88e53203-891a-46f8-9ced-81d874a271c4",
			"created_at": "2022-10-25T16:07:24.191982Z",
			"updated_at": "2026-04-10T02:00:04.895327Z",
			"deleted_at": null,
			"main_name": "Silence",
			"aliases": [
				"ATK 86",
				"Contract Crew",
				"G0091",
				"TAG-CR8",
				"TEMP.TruthTeller",
				"Whisper Spider"
			],
			"source_name": "ETDA:Silence",
			"tools": [
				"EDA",
				"EmpireDNSAgent",
				"Farse",
				"Ivoke",
				"Kikothac",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Meterpreter",
				"ProxyBot",
				"ReconModule",
				"Silence.Downloader",
				"TiniMet",
				"TinyMet",
				"TrueBot",
				"xfs-disp.exe"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434472,
	"ts_updated_at": 1775826687,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/6e23d1c446a1d109f68df2cfc2d3244bd8197766.pdf",
		"text": "https://archive.orkl.eu/6e23d1c446a1d109f68df2cfc2d3244bd8197766.txt",
		"img": "https://archive.orkl.eu/6e23d1c446a1d109f68df2cfc2d3244bd8197766.jpg"
	}
}