3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
Horus Team

Horus Team

ID: 5220f70b399cf82f36d3fc3114e0535a
Hacktivist Group DDoS Crew Hacktivism
Threat types: DDoS, Hacktivism
Russia UKR
Updated: 2026-04-07
Created: 2026-02-09
Progress: 87% Completeness: 85% Freshness: 90%
Operation zone: Ukraine
Aliases Limited alias preview
HorusTeam — — —
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: medium
Actor Techniques page ATT&CK® Diagram

Horus Team is an OSINT-observed hacktivist brand appearing in coalition membership and alliance reporting tied to pro-Russian disruptive campaigns. Open sources most strongly support coalition-level association (High Society; NoName057(16) partner lists) and a DDoS-centric threat model focused on availability disruption and claim amplification.


Technique Technique name Tactics Evidence
T1498 Network Denial of Service TA0040
  • 2024-03-01 — Coalition context: Horus Team is listed among groups aligned with NoName057(16), a DDoS-focused collective; availability disruption is the primary modeled activity. · ref
  • 2025-05-01 — DDoS landscape reporting reinforces the relevance of NoName057(16)-style alliances for ongoing DDoS risk modeling; Horus Team appears in allied-brand contexts. · ref
T1589 Gather Victim Identity Information TA0043
  • 2024-10-01 — INFERENCE (confidence: medium): Hacktivist coalitions select symbolic/strategic targets using publicly available information about organizations and exposed services; apply as context rather than Horus-specific proof. · ref
T1593 Search Open Websites/Domains TA0043
  • 2024-10-01 — INFERENCE (confidence: medium): Targeting and narrative operations commonly rely on searching public websites/domains for high-visibility endpoints and messaging opportunities. · ref
T1583.004 Server TA0042
  • 2024-03-01 — INFERENCE (confidence: low–medium): Coalition DDoS operations typically involve rented infrastructure (VPS/proxies) and traffic sources beyond single endpoints; treat as supporting context. · ref
Strategic Intelligence
Limited preview
Last updated: 2026-02-17T20:45:12+00:00

Horus Team — Pro‑Russian hacktivist collective (DDoS‑centric) associated with the “High Society” alliance

Classification: TLP:WHITE - Open Source Intelligence (OSINT)

Category: Cyber / Hacktivism - Origin: INFERENCE (confidence: medium): Russia-linked ecosystem

Author: iQBlack CTI Team

 


Executive Summary

Horus Team is an OSINT-observed hacktivist brand appearing in public coalition lists tied to pro‑Russian disruptive campaigns, primarily focused on denial‑of‑service activity and public claim amplification.

Public reporting most consistently places Horus Team as a member of the ‘High Society’ hacktivist alliance and as a named partner in alliances announced by NoName057(16), a Russia‑linked DDoS collective that operationalized the ‘DDoSia’ volunteer model.

Direct, independently verified victim attributions attributable solely to Horus Team remain sparse in open reporting; confidence is higher at the coalition/umbrella level (High Society / NoName057(16) partner lists) than at the single‑actor incident level.

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Saved Limited preview

Executive Analyst Brief for CISO — Horus Team

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Upgrade to access the full executive brief.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Saved Limited preview

Hunting Playbook — Horus Team


Upgrade to access the full hunting playbook.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Saved Limited preview
Last updated: 2026-04-07T18:29:10+00:00


This appendix summarizes a conservative set of indicators associated with Horus Team at the ecosystem / coalition level.

More IOC context for Research. Full appendix for Analyst and Premium plans.
IOC Appendix now
Saved successfully.
OSINT Library
Saved Limited preview
Last saved: 2026-02-17T20:59:02+00:00

OSINT Library — Horus Team

2024-03-01 — Sekoia.io Threat Detection & Research — “NoName057(16) DDoSia project: 2024 updates and behavioural shifts”https://blog.sekoia.io/noname05716-ddosia-project-2024-updates-and-behavioural-shifts/

Scope/Notes: Documents NoName057(16) coalition-building and explicitly lists Horus Team among allied groups (useful coalition-level attribution and targeting context).

Full OSINT references available for Research / Analyst.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/7
Address Verification SOCMINT
t.me/hor**************** Restricted Not integrated
t.me/Hor******* Restricted Not integrated
t.me/vpn****** Restricted Not integrated
t.me/hor********** Restricted Not integrated
t.me/Hor********** Restricted Not integrated
t.me/Hor*********** Restricted Not integrated
t.me/Hor************ Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
Showing 1–5 of 5 images
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Logo / Avatar Free Preview
Logo / Avatar
Logo / Avatar Free Preview
Logo / Avatar
Logo / Avatar Free Preview
Logo / Avatar
Showing 4 of 5 images in preview mode. Additional evidence is restricted for Analyst and Premium plans.