# CyberBerkut

CyberBerkut (Russian: КиберБеркут, Ukrainian: КіберБеркут) is a modern organized group of pro-Russian hacktivists. The group became locally known for a series of publicity stunts and distributed denial-of-service (DDoS) attacks on Ukrainian government, and western or Ukrainian corporate websites. By 2018, this group was accused by western intelligence agencies, such as National Cyber Security Centre (United Kingdom) of being linked to the GRU, providing plausible deniability.

## Background

The group emerged after the dissolution of special police force "Berkut" that became notorious for its violent repression used during the EuroMaidan demonstrations. The group is anonymous. Their proclaimed goals are fighting against neo-fascism, neo-nationalism and arbitrary power in Ukraine. To further this aim, CyberBerkut activists targeted the "Right Sector" IT resources. CyberBerkut targets included NATO, and its allies.

## Activity

* Attacks on NATO websites.
* Attacks on U.S. private military companies.
* Publication of correspondence of deputies of (political parties) Batkivshchyna and Ukrainian Democratic Alliance for Reform.
* Publication of correspondence with the United States Embassy in Ukraine and United States foundations.
* Disclosure to public of telephone recording between Yulia Tymoshenko and Nestor Shufrych.
* Disclosure to public of telephone recording between EU High Representative for Foreign Affairs Catherine Ashton and Foreign Minister of Estonia Urmas Paet.
* Blocking cellular phones of members of the Yatsenyuk Government and persons close to them.
* Blocking Internet resources of Secretary of the National Security and Defence Council of Ukraine Andriy Parubiy and news portals: LigaBusinessInform and Ukrainian Independent Information Agency.
* Publication of video materials that are blocked on YouTube.
* Attempts at disrupting the recruitment of the National Guard of Ukraine.
* Attempted destruction of the electronic system of the Central Election Commission of Ukraine prior to the 2014 Ukrainian presidential election.
* Publishing lists of alleged Ukrainian military deserters
* Attempts at disrupting the work of the Central Election Commission of Ukraine by damaging the IFES system before the elections and blocking cellphones of their organisators.
* Temporary disruption of the websites of the Ministry of Internal Affairs and the General Prosecutor of Ukraine. Websites of TV channels 1+1 and Inter were also temporary disrupted.
* Email hacking and publication of the conversation between Ihor Kolomoyskyi and the persecutor of the Lviv Oblast, hacking of the computer and email of a person related to Ihor Kolomoyskiy. Archives of the contents of 89 email accounts of Lviv oblast's prosecutor office employees.
* Hacking and publishing of the Minister of Internal Affairs Arsen Avakov's conversation.
* Blocking of the website of the President of Ukraine Petro Poroshenko on 29 June 2014.
* Publication of the real name and biography of Semen Semenchenko – Konstantin Grishin.
* Hacking of the German Chancellery and the German Bundestag
* Hacked U.S. Senator John McCain's computers during a visit to Ukraine in 2015 and released a video depicting a fake ISIS beheading video being filmed
The group also publishes pro-Donetsk People's Republic videos. In one of them it is claimed that Ukrainian security forces are living under a "Jewish occupation".

## Response

* Repeated blocking of CB's Facebook pages, although new ones have been made on the following day.
* Likely in response to attacking the websites of Greystone Limited and Triple Canopy, CyberBerkut's websites have been temporarily disrupted. The websites started to work again on the following day.
* Arrests of people suspected in relation to CyberBerkut.