Loading threat actor…
XakNet is a Russia-aligned hacktivist or cybercriminal persona active in the context of Russia’s war against Ukraine. It has been publicly described as a Russian hacker group and, in some reporting, as a likely fake hacktivist persona created or supported by Russian intelligence services. XakNet has been associated with pro-Russian cyber activity directed at Ukrainian and Western targets and has been named alongside other Russia-aligned groups such as Killnet. Reporting also indicates possible cooperation or association with Killnet-linked actors. The group is known for hack-and-leak style operations. In May 2022, XakNet claimed responsibility for breaching Ukraine’s Ministry of Foreign Affairs and publishing exfiltrated documents, including offering rewards to supporters to analyze the stolen material. This demonstrates data theft and exfiltration capabilities in support of pro-Russian information and influence objectives around the war. XakNet has also been cited in government and industry reporting as part of the broader ecosystem of Russian-aligned non-state cyber actors mobilized in support of Moscow following the invasion of Ukraine. XakNet has been included in joint Western government warnings about Russian-aligned cyber threats to critical infrastructure, reflecting concern that such groups may conduct disruptive operations, particularly against organizations perceived as supporting Ukraine. Although XakNet is frequently grouped with DDoS-oriented actors in the pro-Russian ecosystem, the strongest directly supported activity for XakNet itself is intrusion followed by theft and public release of data against Ukrainian government targets. Known aliases include The XakNet Team, xaknet_team, and the_xaknet_team.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named threat actor referenced in reporting on Russia's cyber tactics.
Purported hacktivist persona described as a Russian intelligence-created false front to mask state operations as hacktivism.
Russian-aligned group referenced as conducting cyber-attacks against Ukrainian and Western targets.
A self-described Russian hacktivist group presented as aligned with Moscow, linked here to attempted cyber activity against Ukrainian power infrastructure and several hack-and-leak incidents during the war.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.