Loading threat actor…
Cyber Anarchy Squad (C.A.S.) is a pro-Ukraine hacktivist group active since 2022 that has primarily targeted organizations in Russia and Belarus, with later activity expanding to Kazakhstan, the United Arab Emirates, Egypt, and Syria. The group has been associated with attacks against government-linked entities as well as telecommunications, healthcare, aviation, industrial, and other commercial organizations. Its operations are intended to cause operational disruption, reputational harm, and, in some campaigns, financial damage. C.A.S. is known for exploiting vulnerabilities in public-facing services for initial access rather than relying primarily on phishing. Reported intrusion vectors include exploitation of Microsoft Exchange ProxyShell and vulnerabilities affecting products such as Jira, Confluence, and Microsoft SQL Server. After compromise, the group has used web shells, PowerShell and command-shell execution, remote administration utilities, reverse shells, and open-source RATs to establish footholds and conduct post-exploitation activity. Observed tooling associated with C.A.S. or overlapping campaigns includes Meterpreter, Revenge RAT, Spark RAT, Sliver, Havoc, Mythic Apollo, AdaptixC2, BlackSalt, and legitimate dual-use remote-management tools. The group has demonstrated broad post-compromise capability, including reconnaissance, credential theft, persistence through creation of administrative accounts and remote-access enablement, disabling or bypassing security tooling, and data exfiltration. It has also been linked to use of BYOVD-based security-tool killers and other defense-evasion measures. C.A.S. publicizes operations through Telegram and has claimed theft of internal databases, employee documents, and other sensitive information in support of reputational pressure campaigns. C.A.S. has also been linked to destructive and extortion-oriented activity. Reporting ties the group and closely related campaigns to ransomware built from leaked LockBit and Babuk builders, as well as to ClearWater ransomware and cooperation around attacks involving Blackout Locker. In some cases, operations combined data theft, encryption, and destructive actions such as wiping Linux systems, indicating a blend of hacktivist sabotage and financially motivated behavior. Researchers have also noted operational overlap or cooperation between C.A.S. and other pro-Ukrainian hacktivist groups including 4BID, Hakerskii Kit, Goffee, Ukrainian Cyber Alliance, RUH8, RM-RF, and DARKSTAR, with shared access, tooling, or infrastructure complicating attribution.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
111 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist group active against Russian organizations, motivated by disruption and public pressure.
Hacktivist group observed in the same compromised environments as 4BID; associated in the report with ClearWater ransomware activity and possible collaboration or links with other groups.
Упомянутая в исследовании проукраинская группа, связанная с пересекающейся активностью и, вероятно, содействием в атаках, где использовался ClearWater. Также фигурирует среди групп, которым потенциально может принадлежать инфраструктура C2/эксфильтрации.
Interconnected hacktivist group associated with overlapping activity and possible contribution to ClearWater-linked attacks.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.