# Russian hacking in Ukraine: 15 Sourced Claims, Contested Facts & Evidence Authors: joe HTML: https://moyomap.com/maps/russian-hacking-ukraine Markdown: https://moyomap.com/maps/russian-hacking-ukraine.md License: HTML and markdown are for reading and citation. Bulk copying and AI training need a written license. See /terms and /developers#maps-data. Cite a claim as: MoyoMap, "Russian hacking in Ukraine: 15 Sourced Claims, Contested Facts & Evidence", claim {id}, https://moyomap.com/maps/russian-hacking-ukraine.md#{id}. “Moyo, a product of SenTeGuard Inc.” ### CERT-UA reported a shift in Russian cyber operations from one-time credential theft to re-compromising previo… Id: claim_12e39b18f1c7903c4ece5711 Parent: topic_xwSBusg3gez1I78O10JT Depth: 1 CERT-UA reported a shift in Russian cyber operations from one-time credential theft to re-compromising previously breached systems for persistent espionage. Labels: Inferred, Low, known ### Russian-linked actors, including Seashell Blizzard, have breached networks of international organizations and… Id: claim_19c5d1901a9e263315b50c4e Parent: topic_xwSBusg3gez1I78O10JT Depth: 1 Russian-linked actors, including Seashell Blizzard, have breached networks of international organizations and law firms involved in war crimes investigations. Labels: Source-linked, High, known ### Anthropic's September 2026 report identifies a Russian-speaking operator using the handle 'JackPoterz' (GTG-2… Id: claim_1a5b3927e14015f152a72cfa Parent: topic_xwSBusg3gez1I78O10JT Depth: 1 Anthropic's September 2026 report identifies a Russian-speaking operator using the handle 'JackPoterz' (GTG-20006) conducting espionage against Ukrainian and European government military intelligence targets. Labels: Source-linked, High, known ### In October 2020, the US indicted six GRU Unit 74455 officers for cyberattacks including the 2015/2016 Ukraini… Id: claim_2675b5f57217256c9c0bbf21 Parent: topic_xwSBusg3gez1I78O10JT Depth: 1 In October 2020, the US indicted six GRU Unit 74455 officers for cyberattacks including the 2015/2016 Ukrainian power grid attacks, NotPetya, the 2017 French presidential campaign hack, the 2018 Olympic Destroyer attack, and the 2018 OPCW operation. Labels: Source-linked, Medium, known ### On September 29, Microsoft disclosed that FSB-linked Star Blizzard conducted at least 13 large phishing campa… Id: claim_8b5259a9cd01d839b181f7db Parent: topic_xwSBusg3gez1I78O10JT Depth: 1 On September 29, Microsoft disclosed that FSB-linked Star Blizzard conducted at least 13 large phishing campaigns in 2026 against over 100 organizations using a 'RedFlick' chain to install the CosmicPulse backdoor. Labels: Source-linked, Medium, known ### Pro-Russian hacktivist groups like NoName057(16) launch DDoS and defacement attacks within 24 to 72 hours of… Id: claim_9a1a86254391fbad97faa8e8 Parent: topic_xwSBusg3gez1I78O10JT Depth: 1 Pro-Russian hacktivist groups like NoName057(16) launch DDoS and defacement attacks within 24 to 72 hours of political triggers. Labels: Source-linked, Low, known ### 2025-2026 Cyber Incident Statistics Id: section_3e87e94447c71b328160fdd4 Parent: topic_xwSBusg3gez1I78O10JT Depth: 1 2025-2026 Cyber Incident Statistics Labels: Inferred, Low ### Sandworm Unit Overview and Operations Id: section_f1be90b203f961a01205605b Parent: topic_xwSBusg3gez1I78O10JT Depth: 1 Sandworm Unit Overview and Operations Labels: Inferred, Low #### Between January 2025 and January 2026, CybelAngel recorded 1,651 cyber incidents targeting Ukrainian entities… Id: claim_9f2c1c06e2fc339f5023f33c Parent: section_3e87e94447c71b328160fdd4 Depth: 2 Between January 2025 and January 2026, CybelAngel recorded 1,651 cyber incidents targeting Ukrainian entities and 575 targeting Russian entities. Labels: Source-linked, Low, known #### Sandworm has been active since at least 2009 and is tracked under aliases including APT44, Seashell Blizzard,… Id: claim_bad494a3ed45427b5f18324e Parent: section_f1be90b203f961a01205605b Depth: 2 Sandworm has been active since at least 2009 and is tracked under aliases including APT44, Seashell Blizzard, Voodoo Bear, and Telebots. Labels: Inferred, Low, known #### Sandworm coordinates with hacktivist front groups to execute strategic data leaks, providing the GRU with pla… Id: claim_bfe8e5bc68719112f913f12f Parent: section_f1be90b203f961a01205605b Depth: 2 Sandworm coordinates with hacktivist front groups to execute strategic data leaks, providing the GRU with plausible deniability. Labels: Inferred, High, known #### The NotPetya malware was a wiper disguised as ransomware, distributed by replacing a legitimate update of the… Id: claim_de362039df1b93bf3218e0c1 Parent: claim_2675b5f57217256c9c0bbf21 Depth: 2 The NotPetya malware was a wiper disguised as ransomware, distributed by replacing a legitimate update of the Ukrainian accounting software M.E.Doc. Labels: Inferred, Low, known #### Sandworm is a Russian offensive cyber unit attributed to the GRU's Main Center for Special Technologies (GTsS… Id: claim_f635d5a34d7cd3c4668fe1bc Parent: section_f1be90b203f961a01205605b Depth: 2 Sandworm is a Russian offensive cyber unit attributed to the GRU's Main Center for Special Technologies (GTsST), military unit 74455. Labels: Inferred, Medium, known ##### 84% of recorded cyber activity against Ukraine is DDoS, while 62% of activity against Russia consists of data… Id: claim_3c9793d8e3153789b7438cba Parent: claim_9f2c1c06e2fc339f5023f33c Depth: 3 84% of recorded cyber activity against Ukraine is DDoS, while 62% of activity against Russia consists of data breach claims and 26% is defacement. Labels: Inferred, Low, known ##### ESET documented an upgraded MATCHBOIL downloader from UAC-0099, a group that supplies initial access to Sandw… Id: claim_4f2a0fa03fee7db954408e35 Parent: claim_f635d5a34d7cd3c4668fe1bc Depth: 3 ESET documented an upgraded MATCHBOIL downloader from UAC-0099, a group that supplies initial access to Sandworm, targeting Ukrainian energy, transport, and manufacturing firms. Labels: Inferred, Medium, known