Loading threat actor…
Hakerskii Kit is a hacktivist threat actor associated with a broader cluster of interconnected campaigns linked with medium confidence to groups including 4BID, C.A.S., and Goffee. The actor has been observed claiming attacks against Russian organizations and participating in operations that expanded beyond Russia and Belarus to target organizations in Kazakhstan, the United Arab Emirates, Egypt, and Syria. Activity attributed to this cluster indicates a shift from primarily politically motivated disruptive operations toward broader campaigns that also incorporate ransomware and tooling consistent with financially motivated intrusion sets. Operations associated with Hakerskii Kit relied heavily on exploitation of Microsoft Exchange ProxyShell vulnerabilities for initial access. Post-compromise activity included deployment of an ASP.NET web shell for remote command execution, file transfer, and host reconnaissance; installation of legitimate remote management and monitoring tools; use of custom scripts; and deployment of multiple post-exploitation frameworks and backdoors. Observed tooling across the associated campaigns included Sliver, Havoc, Mythic Apollo, AdaptixC2, BlackSalt, AnyDesk, Panorama9, Tactical RMM, Dev Tunnels, and Nezha Monitoring. The actor cluster demonstrated broad post-exploitation capability, including command execution, persistence through local account creation and remote access enablement, reconnaissance, exfiltration, process control, and defense evasion. Defense evasion included use of modified and open-source EDR-killing utilities that abused vulnerable drivers to terminate security products from kernel mode. Ransomware-linked activity was also observed in compromised environments, including ClearWater ransomware and an updated Blackout Locker variant. These operations indicate that Hakerskii Kit is part of an evolving ecosystem of hacktivist-branded actors whose campaigns blend ideological targeting with increasingly mature intrusion tradecraft and extortion-enabling tooling.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
111 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Interconnected hacktivist group publicly claiming attacks overlapping with ClearWater ransomware activity in Russian infrastructure.
Hacktivist activity targeting organizations across Kazakhstan, the UAE, Egypt, and Syria.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.