BlackJack — Hacktivist Profile
BlackJack is a pro-Ukrainian hacktivist group, first publicly reported in December 2023, that conducts destructive cyberattacks against Russian organizations and is reportedly linked to or supported by Ukraine's Security Service (SBU). It has claimed disruptive attacks against the Moscow ISP M9 Telecom (in stated retaliation for the Kyivstar breach), the water utility Rosvodokanal, and the Moscow municipal infrastructure operator Moskollektor using custom ICS/OT malware called Fuxnet, as well as exfiltration of construction documents for Russian military sites. The group has a documented record of overstating impact: independent analysis of its own leaked data showed the Moskollektor damage was far smaller than claimed. Kaspersky researchers have documented significant tooling and infrastructure overlap between BlackJack and the hacktivist cluster "Twelve", suggesting the two operate as a coordinated or shared cluster targeting Russia.
Countries linked to this actor
Read the full analysis on IntelFusions