Threat Actor Characterization
CyberDragon
ID: 4c05b1e5e29d9d8b9d060a33399e271c| Cyber Dragon | Cyber Drakon | Cy********* | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
5220f70b399cf82f36d3fc3114e0535a | Horus Team | Russia | ally-of | Hacktivist Group |
|
6c787c3b8f5c8385213bd014e9367e3355667 | Narodnaya CyberArmiya | Russia | ally-of | Hacktivist Group |
|
78dd1c3c3dfc6fcbbda95d743ab0e2f732121 | NoName057(16) | Russia | ally-of | Hacktivist Group |
|
958a59d20a43b9f22f914bc556fb14f439035 | Pankratova | Russia | ally-of | Cybercrime |
|
ba0e9ae91ba1b9b5b915d1d4b147736311264 | SKILLNET | Russia | ally-of | Hacktivist Group |
|
|
a51ebeeee9fccf528ada17b7db5c10fd | SoubearArmy | Russia | ally-of | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1498 | Network Denial of Service | TA0040 |
|
| T1585 | Establish Accounts | TA0042 |
|
CyberDragon — Pro-Russian hacktivist collective (Telegram-mobilized)
Classification: TLP:WHITE - Open Source Intelligence (OSINT)
Category: Hacktivism / Hybrid influence - Origin: Russia-aligned (INFERENCE, confidence: medium)
Author: iQBlack CTI Team
Executive Summary
CyberDragon is referenced in multiple open-source reports as a pro‑Russian hacktivist collective active on Telegram and associated with episodic, event-driven campaigns rather than long-duration covert espionage. Public reporting places the name among pro‑Russian group lists tied to anticipated disruption attempts against high-visibility international events (notably Paris 2024 Olympics) and to Telegram-centered mobilization waves (e.g., “#FreeDurov” solidarity campaigns) where multiple collectives coordinated site disruption activities.
Open reporting does not consistently provide a stable technical fingerprint (malware family, custom tooling, unique infrastructure). As a result, CyberDragon is best treated as a brand label within a broader pro‑Russian hacktivist milieu whose operational tempo rises around geopolitical triggers and media moments. Attribution to a single operator set is therefore uncertain; defenders should treat claims and hit-lists as OSINT indicators of intent, and validate against telemetry (DDoS traffic patterns, web service health, and defacement artifacts) before concluding direct responsibility.