Twelve

Twelve is a hacktivist threat actor that emerged in April 2023 in the context of the Russia-Ukraine conflict and has primarily targeted Russian organizations, especially government entities. The group is known for destructive intrusions that combine data theft, public exposure of stolen information, ransomware-style encryption, and subsequent wiping intended to maximize operational damage and hinder recovery. Its activity indicates a sabotage-oriented model rather than conventional profit-driven ransomware operations. Twelve commonly gains initial access through valid local or domain accounts, as well as stolen VPN or SSH certificates, including by first compromising contractors and then abusing trusted access into customer environments. The group has also been linked to scanning for internet-exposed remote access services and applications. After entry, it uses publicly available offensive tooling for reconnaissance, credential access, privilege escalation, lateral movement, and command and control. Reported tooling includes Cobalt Strike, mimikatz, BloodHound, PowerView, adPEAS, CrackMapExec, PsExec, chisel, ngrok, and network-scanning utilities. Lateral movement has frequently relied on RDP, SMB-based remote execution, and PowerShell remoting. For persistence and post-exploitation, Twelve has used PHP web shells on compromised web servers, manipulated Active Directory users, groups, and ACLs with PowerShell and native utilities, and attempted domain-wide malware deployment through scheduled tasks and Group Policy changes. In at least one case, the group exploited VMware vSphere vulnerabilities CVE-2021-21972 and CVE-2021-22005 to compromise vCenter and deploy the FaceFish backdoor. Defense evasion has included masquerading malware and scheduled tasks as legitimate software or services, clearing Windows event logs, and removing forensic artifacts such as RDP history and recent execution traces. Credential theft and collection are central to Twelve’s operations. The group has dumped credentials from LSASS, extracted Active Directory credential material including NTDS data and registry hives, and used password-recovery software to harvest additional secrets from compromised systems. It has also collected sensitive victim data including financial documents, technical materials, corporate communications, and messaging-session data, then archived and exfiltrated that information for later publication. For impact, Twelve has deployed ransomware variants derived from LockBit 3.0 source code and also used builds associated with Chaos. Encryption has been distributed broadly across victim environments via administrative shares, PowerShell, scheduled tasks, and Group Policy. Unlike financially motivated ransomware actors, Twelve’s ransom artifacts reportedly lacked meaningful negotiation channels. The group has also deployed Shamoon-like wipers that overwrite file contents and the master boot record, rendering systems unbootable and frustrating restoration efforts. This encrypt-then-wipe pattern is a defining characteristic of the actor. Twelve has conducted hack-and-leak operations through a Telegram presence used to publicize compromises and release stolen data. Researchers have identified substantial overlaps in infrastructure, tooling, and tradecraft between Twelve and other Russia-targeting clusters including Head Mare, BlackJack, Crypt Ghouls, and DARKSTAR, also known as COMET or Shadow. Shared use of malware, loaders, tunneling tools, credential-harvesting utilities, and command-and-control infrastructure suggests collaboration, shared resources, or participation in a broader pro-Ukrainian hacktivist ecosystem targeting Russian state and private-sector organizations.