CyberBerkut
CyberBerkut is a Russia-attributed threat actor group with an ideological motive, tracked by Brandefense. It targets 3 sectors, including Government and Finance, in 4 countries, including the United States and Germany.
- Kiberberkut
- Origin
- Russia
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2014
- Last seen
- Sep 28, 2016
- Record updated
Who They Target.
Campaigns.
- Targeting of Bellingcat MH17 InvestigatorsSep 2016
About CyberBerkut.
A pro-Russian hacktivist front suspected of acting as a proxy or cover for Russian state security services conducting active measures, website defacements, and leaks. This article presents temporal and technical analysis of these activities, based on open source intelligence (OSINT) from the Web. Appropriating the Ukrainian special police force name and logo, the group has aligned itself as pro-Russian, anti-Ukrainian, and most recently attacked Western intervention efforts in the Ukrainian conflict.
While the group has taken Ukrainian identities, technical links and contextual analysis connect the group to Russia. The group began with successful distributed denial of service (DDoS) attacks on multiple NATO websites just as separatists in the physical world were beginning to storm military buildings. Since their initial attacks the group has continued to take down websites, and most recently leaked confidential documents between US billionaire George Soros and the Ukrainian prime minister and president which contained plans for Western intervention.
Last updated Nov 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.