ETDA ThaiCERT
Report
Search
Home > List all groups > Cyber Berkut

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Cyber Berkut

NamesCyber Berkut (self given)
Kiberberkut (self given)
CountryRussia Russia
MotivationInformation theft and espionage, Sabotage and destruction
First seen2014
Description(Recorded Future) Recorded Future has collected threat intelligence on the hacking activities of Cyber Berkut for over a year, aligning with the first month of ground fighting in Ukraine, at which time the group began coordinated cyber attacks. This article presents temporal and technical analysis of these activities, based on open source intelligence (OSINT) from the Web. Appropriating the Ukrainian special police force name and logo, the group has aligned itself as pro-Russian, anti-Ukrainian, and most recently attacked Western intervention efforts in the Ukrainian conflict. While the group has taken Ukrainian identities, technical links and contextual analysis connect the group to Russia.

The group began with successful distributed denial of service (DDoS) attacks on multiple NATO websites just as separatists in the physical world were beginning to storm military buildings. Since their initial attacks the group has continued to take down websites, and most recently leaked confidential documents between US billionaire George Soros and the Ukrainian prime minister and president which contained plans for Western intervention.
ObservedSectors: Defense, Financial, Government.
Countries: Estonia, Germany, Ukraine, USA, NATO.
Tools used
Operations performedMar 2014Nato websites disabled by cyber attack on eve of Crimea vote
<https://www.ft.com/content/b822d5cc-ace6-11e3-8ba3-00144feab7de>
Jul 2014'Cyber Berkut' Hackers Target Major Ukrainian Bank
<https://www.themoscowtimes.com/2014/07/04/cyber-berkut-hackers-target-major-ukrainian-bank-a37033>
Jan 2015German government websites, including Chancellor Angela Merkel’s page, were hacked on Wednesday in an attack claimed by a group demanding Berlin end support for the Ukrainian government, shortly before their leaders were to meet.
<https://www.reuters.com/article/us-germany-cyberattack/pro-russian-group-claims-cyber-attack-on-german-government-websites-idUSKBN0KG15320150107>
May 2015Cyber Berkut Graduates From DDoS Stunts to Purveyor of Cyber Attack Tools
<https://www.recordedfuture.com/cyber-berkut-analysis/>
Information<https://www.recordedfuture.com/cyber-berkut-analysis/>
<https://en.wikipedia.org/wiki/CyberBerkut>

Last change to this card: 19 April 2020

Download this actor card in PDF or JSON format

Previous: Cutting Kitten, TG-2889
Next: Cyber Caliphate Army (CCA), United Cyber Caliphate (UCC)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key