BO Team

BO Team, also known as Black Owl, Hoody Hyena, and Lifting Zmiy, is a pro-Ukraine hacktivist threat group active since at least early 2024 and assessed to operate in alignment with Ukrainian interests. Public reporting has linked the group to cooperation with Ukraine’s military intelligence service, HUR/GUR, in disruptive and destructive operations against Russian organizations. BO Team has targeted Russian state, commercial, and strategically significant entities, including organizations tied to telecommunications, manufacturing, oil and gas, healthcare, aerospace, drone development, digital-signature services, and other critical or defense-adjacent functions. Some reporting also notes targeting of Belarusian organizations. The group is known for combining hacktivist disruption with more sustained intrusion activity. Its operations have included phishing-based initial access, malware delivery, credential theft, covert backdoor deployment, data exfiltration, destructive actions, and extortion. BO Team commonly uses targeted phishing emails with malicious attachments disguised as legitimate business documents. Observed tooling includes BrockenDoor, ZeronetKit, DarkGate, Remcos, and in some cases Babuk ransomware. BrockenDoor has been used as a downloader and persistence mechanism for follow-on payloads such as the Go-based ZeronetKit backdoor, which supports remote shell access, file transfer, and tunneling. Reporting also associates the group with use of post-exploitation frameworks and legitimate remote administration tools, as well as living-off-the-land techniques. BO Team has demonstrated post-compromise capabilities including persistence, endpoint discovery, credential access, extraction of directory data, lateral movement over remote administration protocols, deletion of backups, and destructive wiping of systems and virtualized infrastructure. Multiple reports characterize the group as having evolved from primarily overtly destructive operations toward a mix of sabotage and more covert cyber-espionage activity. Kaspersky reporting in 2026 described BO Team as a serious and continuously evolving threat in the Russian threat landscape and noted an apparent expansion in targeting from healthcare into manufacturing, telecommunications, and oil and gas. The group has been publicly associated with high-impact operations against Russian entities, including attacks on a state space hydrometeorology research center, a major drone supplier, a federal digital-signature authority, telecommunications providers, logistics infrastructure, and online services linked to Russia’s ruling party. Some of these incidents involved claims of large-scale data destruction, server wiping, and theft of technical or administrative data. BO Team has also been described as combining extortion with destructive activity, and some reporting specifically notes use of ransomware in support of extortion. Although earlier assessments described BO Team as relatively autonomous within the pro-Ukraine hacktivist ecosystem, later reporting identified overlapping infrastructure and tooling with Head Mare, suggesting at least some operational coordination. One proposed model is that Head Mare obtains initial access through phishing while BO Team conducts malware deployment and follow-on intrusion activity. BO Team is best understood as a politically motivated, Ukraine-aligned hacktivist actor focused primarily on disruptive, destructive, and intelligence-gathering operations against Russian targets.