Loading threat actor…
Silent Crow is a pro-Ukraine hacktivist group that has claimed responsibility for multiple disruptive and data-theft operations against Russian targets. The group is publicly associated with anti-Russian activity in the context of the Russia-Ukraine war and has collaborated with the Belarusian opposition hacktivist collective Cyber Partisans BY in at least one major operation. Silent Crow is best known for claiming the July 2025 attack on Aeroflot, Russia’s flagship airline, alongside Cyber Partisans BY. That operation caused major flight disruptions and was presented by the actors as a long-running intrusion culminating in destructive impact against the airline’s IT environment and large-scale data exfiltration. Public reporting also links Silent Crow to a claimed breach of Rosreestr, Russia’s state property registry, and to a separate incident involving compromise of a contractor connected to Rostelecom. Russian authorities have sought to designate Silent Crow and Cyber Partisans BY as extremist organizations, citing their claimed attacks on Russian infrastructure and institutions. The group’s observed and claimed tradecraft centers on intrusion into enterprise networks, long-term unauthorized access, expansion of access within victim environments, theft of sensitive data, and destructive post-compromise actions intended to disrupt operations. In the Aeroflot case, reporting described alleged persistence over an extended period, movement into identity infrastructure, acquisition of high-privilege accounts, and destructive effects on servers and business operations, although some operational details remain based on actor claims or unverified reporting. Silent Crow’s targeting pattern is strongly focused on Russian government-linked and strategic organizations, including transportation and public-sector entities. Silent Crow is best characterized as a politically motivated hacktivist actor aligned with Ukrainian interests rather than a conventional financially motivated cybercriminal group or a clearly established state organ. Its known alias in the supplied material is Silent Crow; its closest publicly linked partner group is Cyber Partisans BY.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a Ukraine-aligned cluster with precedent for targeting Russian entities, but not attributed to the incidents discussed.
Pro-Ukraine hacking group that claimed multiple cyberattacks against Russian targets, including Rosreestr and the 2025 Aeroflot incident alongside Belarusian Cyber Partisans.
Group associated with a claimed breach of Russian airline systems and large-scale data exfiltration.
Claimed responsibility for a disruptive intrusion against Aeroflot, reportedly leveraging third-party contractor access (Bakka Soft) to regain entry, establish persistence, move into Active Directory, obtain high-privilege accounts, and deploy multiple malware tools; also reported to have breached a Rostelecom contractor and leaked data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.