IT Army of Ukraine
IT Army of Ukraine is an Ukraine-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets the Finance, and Energy and Utilities sectors in Russia. It uses 1 MITRE ATT&CK technique.
- Ukrainian IT Army
- Origin
- Ukraine
- Techniques
- 1
- Exploited CVEs
- No CVE data
- First seen
- Feb 26, 2022
- Last seen
- Jun 1, 2024
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
1 techniques across 1 of 14 tacticsReconnaissance·
Resource Development·
Initial Access·
Execution·
Persistence·
Privilege Escalation·
Defense Evasion·
Credential Access·
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact1
Network Denial of Service
Campaigns.
- IT Army of Ukraine attack on St. Petersburg International Economic Forum systems (2022-06)Jun 2022
- IT Army of Ukraine DDoS on Rostec website (2022-03)Mar 2022
- IT Army of Ukraine DDoS against Moscow Exchange and Sberbank websites (2022-02)Feb 2022
- Compromised Docker honeypots used for pro-Ukrainian DoS on Russian and Belarusian websites (2022-02)Feb 2022 to Mar 2022
About IT Army of Ukraine.
The IT Army of Ukraine is a volunteer cyber force launched on 26 February 2022, two days after Russia's full-scale invasion, when Ukraine's Minister of Digital Transformation Mykhailo Fedorov set up an offensive volunteer group organised around a Telegram channel. The channel publishes lists of Russian targets, such as banks and financial infrastructure, energy companies and internet providers, and coordinates participants in distributed denial-of-service attacks against them, increasingly through automated, cloud-hosted DDoS tooling that passive supporters can run.
By mid-2022 researchers described two layers: a public, crowdsourced DDoS component and a smaller in-house team reportedly linked to Ukrainian defence and intelligence personnel, and the IT Army reportedly also went beyond DDoS, for example gaining access to the regional electricity utility Loesk in October 2022. The channel peaked at roughly 300,000 members in March 2022 and fell to about 170,000 by August 2023; the group continued to claim large DDoS campaigns against Russian banks as late as June 2024, according to the group's own claims reported by Small Wars Journal.
Last updated Oct 23, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.