CyberBerkut
Group of pro-Russian hackers
From Wikipedia, the free encyclopedia
CyberBerkut (Russian: КиберБеркут, Ukrainian: КіберБеркут) is a modern organized group of pro-Russian hacktivists.[1] The group became locally known for a series of publicity stunts and distributed denial-of-service (DDoS) attacks on Ukrainian government, and western or Ukrainian corporate websites.[2] By 2018, this group was accused by western intelligence agencies, such as National Cyber Security Centre (United Kingdom) of being linked to the GRU, providing plausible deniability.[3]
 resembles emblem of special police unit "Berkut" | |
| Formation | c. 2014 |
|---|---|
| Type | Virtual community;Voluntary association |
| Purpose | Internet activism;Internet vigilantism |
Region served | Ukraine |
| Membership | Unknown |
| Website | cyber-berkut |
Background
The group emerged after the dissolution of special police force "Berkut" that became notorious for its violent repression used during the EuroMaidan demonstrations.[4] The group is anonymous.[citation needed] Their proclaimed goals are fighting against neo-fascism, neo-nationalism and arbitrary power in Ukraine.[citation needed] To further this aim, CyberBerkut activists targeted the "Right Sector" IT resources.[citation needed] CyberBerkut targets included NATO, and its allies.[5]
Activity
- Attacks on NATO websites.[6][7]
- Attacks on U.S. private military companies.[8]
- Publication of correspondence of deputies of (political parties) Batkivshchyna and Ukrainian Democratic Alliance for Reform.[9]
- Publication of correspondence with the United States Embassy in Ukraine and United States foundations.[10]
- Disclosure to public of telephone recording between Yulia Tymoshenko and Nestor Shufrych.[11][nb 1]
- Disclosure to public of telephone recording between EU High Representative for Foreign Affairs Catherine Ashton and Foreign Minister of Estonia Urmas Paet.[13]
- Blocking cellular phones of members of the Yatsenyuk Government and persons close to them.[14]
- Blocking Internet resources of Secretary of the National Security and Defence Council of Ukraine Andriy Parubiy and news portals: LigaBusinessInform and Ukrainian Independent Information Agency.[15]
- Publication of video materials that are blocked on YouTube.[1]
- Attempts at disrupting the recruitment of the National Guard of Ukraine.[citation needed]
- Attempted destruction of the electronic system of the Central Election Commission of Ukraine prior to the 2014 Ukrainian presidential election.[citation needed]
- Publishing lists of alleged Ukrainian military deserters[citation needed]
- Attempts at disrupting the work of the Central Election Commission of Ukraine by damaging the IFES system before the elections and blocking cellphones of their organisators.[16][17]
- Temporary disruption of the websites of the Ministry of Internal Affairs and the General Prosecutor of Ukraine. Websites of TV channels 1+1 and Inter were also temporary disrupted [citation needed].
- Email hacking and publication of the conversation between Ihor Kolomoyskyi and the persecutor of the Lviv Oblast, hacking of the computer and email of a person related to Ihor Kolomoyskiy.[18][19][20] Archives of the contents of 89 email accounts of Lviv oblast's prosecutor office employees.
- Hacking and publishing of the Minister of Internal Affairs Arsen Avakov's conversation.[21]
- Blocking of the website of the President of Ukraine Petro Poroshenko on 29 June 2014.[22]
- Publication of the real name and biography of Semen Semenchenko – Konstantin Grishin.[23]
- Hacking of the German Chancellery and the German Bundestag[24][5]
- Hacked U.S. Senator John McCain's computers during a visit to Ukraine in 2015 and released a video depicting a fake ISIS beheading video being filmed[25]
The group also publishes pro-Donetsk People's Republic videos.[1] In one of them it is claimed that Ukrainian security forces are living under a "Jewish occupation".[1]
Response
- Repeated blocking of CB's Facebook pages, although new ones have been made on the following day [citation needed].
- Likely in response to attacking the websites of Greystone Limited and Triple Canopy, CyberBerkut's websites have been temporarily disrupted. The websites started to work again on the following day.[citation needed]
- Arrests of people suspected in relation to CyberBerkut.[26]
