Researchers say the pro-Ukraine hacktivist group Hacking Cat has expanded from defacements and leaks to destructive intrusions against Russian targets. Kaspersky linked the group to a newly documented remote-access trojan called Gorilla RAT and to Monkey Ransomware, which encrypts files with a .monkey extension; in some cases, attackers reportedly gained initial access by exploiting Microsoft Exchange server vulnerabilities before tunneling deeper into victim networks. The report also ties Hacking Cat to joint operations using Nemo Wiper, malware built to destroy data rather than collect ransom.
Why it matters: This shows hacktivist activity in the Russia-Ukraine conflict becoming more capable and destructive, with real operational impact on targeted organizations. Defenders at exposed Russian and regionally relevant organizations should urgently review Exchange exposure, hunt for Gorilla RAT, Monkey Ransomware, and Nemo Wiper activity, and prepare for data-destructive incidents rather than ordinary website vandalism.
2026.09.14
100% relevant
This article establishes a distinct story by tying Hacking Cat to specific malware families, destructive tradecraft, and a shift from lower-level hacktivism to network intrusion and data destruction against Russian targets.
← Back to all stories