Pro-Russian Hacktivist Groups Targeting the Aviation Sector in 2024: A Study of Telegram Channel Communications

Updated: Dec 26, 2024

Introduction

The ongoing conflict in Ukraine has ignited a surge in hacktivist activity, with pro-Russian groups targeting Ukrainian entities and their allies across various sectors. While the peak of pro-Russian hacktivism was observed in 2023, a steady stream of malicious activities persists. Established groups like Killnet, NoName057(16), Anonymous Russia, Phoenix, and the People's Cyber Army continue to evolve, adopting new structures and expanding their arsenals. Additionally, new pro-Russian factions like Killnet2.0 and JUST EVIL have emerged, further diversifying the threat landscape.

This resurgence of hacktivism, characterized by increased capabilities and wider-reaching impacts, underscores the need for a proactive cybersecurity approach. Hacktivists, motivated by political ideologies, social activism, or financial gain, leverage a range of tactics, from DDoS attacks and website defacements to sophisticated network intrusions and information operations. Their ability to remain anonymous and their diverse objectives make them attractive to both state and non-state actors, amplifying their potential for disruption.

In the face of this evolving threat, proactive monitoring of hacktivist communications on platforms like Telegram has emerged as a critical tool for defenders. By analyzing the discourse, identifying emerging trends, and understanding the motivations behind these attacks, cybersecurity professionals can anticipate threats and implement preemptive measures. The aviation industry, with its reliance on interconnected digital systems, is particularly vulnerable to these attacks. Therefore, this article will explore the use of Telegram channel monitoring as a proactive cybersecurity measure to understand and pre-empt cyber threats from pro-Russian hacktivist groups targeting the aviation sector.

Methodology

To investigate the threat landscape posed by pro-Russian hacktivist groups towards the aviation industry, a systematic data collection and analysis process was employed. The core of this methodology involved the development of a custom Python script designed to monitor public Telegram channels associated with 22 known Russia-linked hacking collectives, curated through open-source research.

The script, leveraging the Telethon library for Telegram API interaction, conducted targeted keyword searches within these channels. Recognizing the language barrier, a curated list of relevant aviation-related keywords (e.g., "aviation," "airport," "airline," "aerospace") was translated into Russian to ensure comprehensive data capture. Upon encountering a keyword match within a message, the script extracted pertinent information, including the message date, content, and any mentioned URLs of allegedly attacked websites. This data was then organized into a structured dataframe for subsequent analysis.

Given the unstructured nature of Telegram messages, the text data from the content column of the dataframe was aggregated for processing by a generative AI model. Specifically, Gemini 1.5 Pro, the latest publicly available model in the Gemini family of generative AI models from Google AI, was chosen for its advanced capabilities in natural language understanding and text summarization. The model was prompted with the following instruction: "Help me to analyze the following Telegram messages and summarize into hacktivist groups involved, list of all organizations with associated countries in bracket and dates in square bracket, motives and tactics - {collapsed text}." The generated summary (Img1), providing a concise overview of the hacktivist landscape, was then output to a .txt file for further human review and interpretation.

Img1. Analysis summary from Gemini GenAI

Through this approach, the monitoring of 22 Russia-linked hacking groups' Telegram channels revealed that seven pro-Russian hacktivist groups had claimed cyber attacks against aviation entities in their public channels throughout 2024.

In addition to the script for data collection and analysis, a separate Python script was developed to monitor the Telegram channels of the identified pro-Russian hacktivist groups in real-time. This script, also utilizing the Telethon library, periodically checks for new messages in these channels. Upon detecting a new message, the script extracts relevant information and posts a notification via Telegram bot (telebot) to a designated Telegram channel used for monitoring purposes (Img2). This real-time monitoring capability allows for immediate awareness of new threats and potential attacks, enabling a more proactive and timely response from cybersecurity professionals.

Img2. Telegram Monitoring

Analysis

The analysis of the messages from the seven pro-Russian hacktivist groups' public telegram channels reveals a sustained campaign by pro-Russian hacktivist groups targeting the aviation sector in 2024, with numerous claimed attacks (Refer to Annex for details). The EMEA region (Chart1), particularly Italy, has been the primary focus of these attacks, with airports (Chart3) being the most frequently targeted entities. While the attacks began in January and have persisted throughout the year, their frequency has varied. This overview underscores the ongoing threat posed by these groups to the aviation industry, particularly in the EMEA region and at airports.

These hacktivist groups are primarily motivated by retaliation for perceived anti-Russian sentiment and actions, and opposition to Western foreign policy and NATO. Their tactics include Distributed Denial of Service (DDoS) attacks, information warfare, website defacement, data breaches, and collaboration with other groups. These attacks not only aim to cause operational disruptions and financial damage but also serve as a platform for spreading propaganda and intimidating targets. The diverse motives and evolving tactics of these groups highlight the complexity of the threat they pose to the aviation industry and the broader geopolitical landscape.

Chart1. Targeted Region

Chart2. Targeted Country

Chart3. Targeted Aviation Entity

Mitigation and Preparedness

The persistent and evolving threat posed by pro-Russian hacktivist groups necessitates a multi-faceted approach to mitigation and preparedness in the aviation sector:

Enhanced Cybersecurity Measures: Implementing robust cybersecurity measures is paramount. This includes regular security audits, vulnerability assessments, and penetration testing to identify and address weaknesses in systems and networks.
Real-Time Threat Intelligence: Proactive monitoring of hacktivist communications on platforms like Telegram, as demonstrated in this study, can provide valuable threat intelligence. This allows for early detection of potential attacks and enables preemptive action.
Incident Response Planning: Developing and regularly testing incident response plans is crucial. These plans should outline procedures for responding to cyberattacks, minimizing damage, and ensuring business continuity.
Employee Training and Awareness: Educating employees about cybersecurity risks and best practices is essential. This includes training on identifying phishing attempts, social engineering tactics, and other common attack vectors.
Collaboration and Information Sharing: Collaboration between aviation entities, cybersecurity firms, and government agencies is vital. Sharing threat intelligence and best practices can enhance the overall resilience of the aviation sector.

By adopting a proactive and comprehensive approach to cybersecurity, the aviation industry can better mitigate the risks posed by pro-Russian hacktivist groups and ensure the safety and security of its operations.

Conclusion

The ongoing cyber conflict in Ukraine has spurred a surge in pro-Russian hacktivist activities, posing a significant and evolving threat to the aviation sector. These groups, motivated by a complex interplay of political ideologies, retaliatory impulses, and financial incentives, have demonstrated a growing sophistication in their tactics and a widening impact on their targets. The analysis of their communications on platforms like Telegram reveals a sustained campaign against the aviation industry, particularly targeting the EMEA region and airports.

The diverse motives and evolving tactics of these groups underscore the complexity of the threat they pose. Their actions are not merely disruptive but also serve as a platform for spreading propaganda, intimidating targets, and influencing the broader geopolitical landscape. This necessitates a proactive and multi-faceted approach to cybersecurity in the aviation sector.

By enhancing cybersecurity measures, leveraging real-time threat intelligence, developing robust incident response plans, and fostering collaboration and information sharing, the aviation industry can better mitigate these risks. Additionally, educating employees about cybersecurity threats and best practices is crucial in building a resilient defense against these attacks.

The findings of this study emphasize the importance of continuous monitoring and analysis of hacktivist communications as a proactive cybersecurity measure. By understanding the motivations, tactics, and targets of these groups, the aviation industry can anticipate threats, implement preemptive measures, and ensure the safety and security of its operations in the face of this evolving cyber threat landscape.

Annex

Due to the sensitivity of the information and to protect the privacy of the organizations involved, the names of the hacktivist groups are not shown and the names of the organizations targeted have been redacted.

Hacktivist Group 1

Description	This is a pro-Russian hacktivist group that has been linked to attacks on critical infrastructure in the United States, Ukraine, and Slovenia. They are suspected of having ties to Sandworm/APT44, a Russian state-sponsored hacking group. It primarily engages in DDoS attacks and has specifically targeted water and wastewater facilities in the US [1][2][3][4].
Claimed Attack	Airport * (Singapore) [2024-06-20] * (Sweden) [2024-03-04] * (Latvia) [2024-02-22] * (Denmark) [2024-02-26] * (Romania) [2024-06-18] * (South Korea) [2024-06-12] * (Canada) [2024-05-23] * (Bulgaria) [2024-05-23] * (Australia) [2024-05-10] * (Italy) [2024-05-08] * (Italy) [2024-05-04] * (Italy) [2024-02-17] * (Italy) [2024-02-15] * (Slovakia) [2024-04-06] * (Slovenia) [2024-03-28] * (Spain) [2024-04-19] Aviation Body * (Europe) [2024-06-11] Aerospace & Defence * (United States) [2024-06-21] *** (Germany) [2024-03-18]
Motive	· Retaliation against Russophobia: Attacks presented as a response to perceived anti-Russian sentiment and actions. · Opposition to Western foreign policy: Disrupting countries supporting Ukraine in the ongoing conflict. · Anti-NATO stance: Targeting NATO members directly.
Tactic	· Distributed Denial of Service (DDoS) attacks: Primary method used to disrupt websites and online services. · Information warfare: spreading propaganda and disinformation · Collaboration and coordination: Multiple groups working together to amplify impact.

Hacktivist Group 2

Description	This is a pro-Russian hacktivist group that emerged in early 2024 and is known for executing Distributed Denial of Service (DDoS) attacks against websites and online services in countries supporting Ukraine. They utilizes Telegram channels for communication, claiming responsibility for their attacks, and sharing information with their followers [5].
Claimed Attack	Airport * (Singapore) [2024-06-20] * (Romania) [2024-06-18] * (South Korea) [2024-06-12] * (Canada) [2024-05-23] * (Bulgaria) [2024-05-23] * (Australia) [2024-05-10] * (Italy) [2024-05-08] * (Italy) [2024-05-05] * (Italy) [2024-05-04] * (Spain) [2024-04-19] *** (Latvia) [2024-03-11]
Motive	· Pro-Russian sentiment: Many attacks target countries deemed "Russophobic" by the groups, suggesting a motive of retaliation or intimidation in support of Russia's geopolitical interests. · General disruption and chaos: Some attacks, particularly those against transportation infrastructure, seem aimed at causing widespread disruption and economic damage.
Tactic	· Distributed Denial of Service (DDoS) attacks: The messages frequently mention "shutting down" websites, a common outcome of DDoS attacks, which overwhelm servers with traffic. · Website defacement: While not explicitly stated, some messages imply website defacement, with the phrase "install a number of local sites" suggesting the replacement of original content. · Collaboration and coordination: The groups often work together, pooling resources and expertise to amplify their impact. · Information warfare: The messages themselves are a form of information warfare, designed to spread fear, uncertainty, and doubt. · Exploitation of current events: Attacks are sometimes timed to coincide with political tensions or international events, maximizing their propaganda value.

Hacktivist Group 3

Description	This is a pro-Russian hacktivist group that emerged in March 2022, gaining notoriety with cyberattacks against a wide range of targets, including government agencies, media outlets, and businesses in Ukraine, the US, and Europe. Their first known actions involved overwhelming Ukrainian news websites like Zaxid and Fakty UA with distributed denial-of-service (DDoS) attacks, making them inaccessible to readers. These actions indicate their broader aim is to stifle any organizations they deem to be critical of Russia.
Claimed Attack	Airport * (Spain) [2024-06-03] * (Spain) [2024-06-03] * (Spain) [2024-06-03] * (Switzerland) [2024-01-19] * (Estonia) [2024-01-18] * (Romania) [2024-06-18] * (Switzerland) [2024-06-13] * (Italy) [2024-05-08] * (Italy) [2024-05-08] * (Italy) [2024-05-05] * (Italy) [2024-05-04] * (Greece) [2024-03-18] * (Denmark) [2024-02-29] * (Denmark) [2024-02-27] * (Japan) [2024-02-21] * (Italy) [2024-02-15] * (Italy) [2024-02-15] * (Greece) [2024-01-30] Airline * (Spain) [2024-06-03] Aviation Body * (Czech Republic) [2024-3-13] Aerospace & Defence * (Spain) [2024-06-03] * (Italy) [2024-05-17] Government *** (Greece) [2024-03-24]
Motive	· Retaliation for support of Ukraine: This is the most common motive, with attacks targeting countries providing military or financial aid to Ukraine. · Opposition to NATO: Some messages mention opposition to NATO and call for countries to withdraw from the alliance. · Support for Russia: Many messages express support for Russia and condemn actions perceived as hostile to the country. · Anti-Russophobia: Several messages accuse target countries or organizations of Russophobia and frame attacks as punishment for this stance.
Tactic	· DDoS attacks: Distributed Denial of Service attacks are the primary tactic used to disrupt websites and online services. · Website Defacement: While not explicitly mentioned, some messages suggest possible website defacement with phrases like "DDoS-hello" and "send a 'hello'." · Information Operations: The messages themselves serve as a form of information operation, aiming to spread propaganda, intimidate targets, and publicize the hacktivists' actions. · Collaboration: Different groups frequently collaborate on attacks, combining resources and expertise for greater impact.

Hacktivist Group 4

Description	This is a Russian-speaking hacktivist group with ambiguous origins and affiliations, sometimes linked to pro-Russian sentiments. They have claimed responsibility for numerous cyberattacks, primarily targeting entities in countries opposing Russia, including DDoS attacks and data breaches. Their targets have included government websites, telecommunications companies, and critical infrastructure. However, their claims of responsibility should be viewed with caution, as they have been known to exaggerate their involvement or falsely claim credit for attacks [6].
Claimed Attack	Airport * (Belgium) [2024-01-25] * (Belgium) [2024-01-24] * (Netherlands) [2024-01-30] * (Slovenia) [2024-04-01] * (Latvia) [2024-03-11] * (Mexico) [2024-03-01] * (France) [2024-02-01] * (France) [2024-02-01] * (France) [2024-02-01] * (Bulgaria) [2024-01-16] * (Poland) [2024-01-19] * (Poland) [2024-01-19] * (Belgium) [2024-01-27] Aviation Service ***** (Belgium) [2024-01-24]
Motive	· Retaliation for Support of Ukraine: The group explicitly targets organizations in countries providing military and financial aid to Ukraine. · Punishment for "Russophobia": The messages cite perceived anti-Russian sentiment and actions (e.g., naming a square after Dzhokhar Dudayev in Poland) as justification for attacks. · Promotion of Pro-Russian Agenda: The messages frequently use phrases like "Glory to Russia" and demonize Western nations.
Tactic	· DDoS Attacks: The primary tactic is Distributed Denial of Service, overwhelming websites and online services to make them unavailable. · Website Defacement: While not explicitly stated, the messages suggest potential website defacement to spread propaganda. · Information Warfare: The group uses Telegram to disseminate propaganda, boasting about attacks, and intimidate targets. · Collaboration: The messages indicate potential collaboration with other hacktivist groups to enhance their capabilities.

Hacktivist Group 5

Description	This is a pro-Russian hacktivist group that emerged in January 2024, believed to be founded by KillMilk, the former leader of Killnet. It is align with pro-Russian interests and often targets organizations and governments in countries that support Ukraine. While some claim JUST EVIL is purely ideologically motivated, there is evidence that they also engage in financially motivated activities like demanding ransoms and selling stolen data [7][8[9].
Claimed Attack	Airport * (Italy) [2024-05-24] * (Germany) [2024-05-18] * (USA) [2024-03-03] Aerospace & Defence * (UK) [2024-03-28]
Motive	· Disruption: Disrupting airport operations. · Political Statement: Playing Russian music at an airport suggests a political motive, potentially linked to the war in Ukraine. · Data Theft & Exposure: Accessing and potentially leaking sensitive data, as seen with an aerospace & defence company.
Tactic	· Server Access & Control: Gaining access to critical airport systems to cause disruption (e.g., shutting down access keys, closing doors). · Website Defacement: Taking down or manipulating websites. · Data Breaches: Stealing sensitive information from organizations (e.g. employee data) · Manipulation of Public Systems: Using public announcement systems to broadcast messages or music.

Hacktivist Group 6

Description	This a pro-Russian hacktivist group active on Telegram, spreads disinformation to favour Russia in the Ukraine conflict. They leak dubious hacked documents, manipulate information, and might launch DDoS attacks [10].
Claimed Attack	Airport * (Italy) [2024-05-24] * (Germany) [2024-05-22]
Motive	· Disruption of Critical Infrastructure: Targeting airports to cause chaos and spread fear.
Tactic	· DDoS Attack: Disrupting the operations of infrastructure like an airport.

Hacktivist Group 7

Description	This is a pro-Russian hacking group known for launching DDoS (Distributed Denial-of-Service) attacks. Active since at least 2022, they've collaborated with other pro-Russian groups like KillNet. In May 2023, It targeted NATO member states in a cyber campaign alongside KillNet.
Claimed Attack	Airport * (Canada) [2024-06-14] * (Lithuania) [2024-04-05] *** (Germany) [2024-04-04]
Motive	· Anti-NATO Sentiment: The hashtags "#FuckNATO" and the targeting of airports in NATO member countries (Canada, Lithuania, Germany, Luxembourg) strongly suggest opposition to NATO. · Pro-Russia Stance: The repeated use of "Glory to Russia!" and "#GloryToRussia" clearly indicates alignment with Russian interests. · Possible Retaliation: The attacks could be in retaliation for actions taken by NATO or its member states against Russia.
Tactic	· Website Disruption/DDoS Attacks: The messages indicate the targeting of airport, likely using DDoS attacks to render them inaccessible ("shutting down," "unavailable," "disabled"). · Network Intrusion: The compromise of security cameras and a logistics terminal at an airport suggests a more sophisticated network intrusion beyond website targeting. · Publicity and Intimidation: The use of Telegram to announce attacks serves both to publicize the group's actions and potentially intimidate future targets.