Threat Actor Characterization
SMESHARIKI HACKER GROUP
ID: 95bcd06892e304511d11c862e7d22ea830659| SHG | SMESHARIKI | См******* | См************* |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
«Смешарики» (SMESHARIKI HACKER GROUP) is referenced in OSINT as a pro‑Russia hacktivist brand co-claiming incidents with Perunswaroga, including hack‑and‑leak narratives against Ukraine-linked services (veterans service in Dec 2025; MamaPapa clinics in Feb 2026) with claims of sensitive personal/medical data exposure and disruption pressure. Public reporting is claim-driven with limited victim-side telemetry; ATT&CK mapping is conservative, focusing on data collection/exfiltration claims and social-platform amplification. Intrusion methods are marked INFERENCE due to insufficient evidence.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1585.001 | Social Media Accounts | TA0042 | |
| T1567 | Exfiltration Over Web Service | TA0010 | |
| T1589 | Gather Victim Identity Information | TA0043 |
|
| T1498 | Network Denial of Service | TA0040 |
|
SMESHARIKI HACKER GROUP («Смешарики») — Pro‑Russia Hacktivist Brand (Hack‑and‑Leak Claims + DDoS/Disruption Messaging)
Classification: TLP: WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Hybrid — Hacktivism (data-theft claims + disruption); Telegram‑amplified propaganda
Assessed home base: INFERENCE: Russia‑aligned ecosystem (confidence: medium)
Executive Summary
The entity branded as «Смешарики» is referenced in open reporting as a pro‑Russia hacktivist group involved in hack‑and‑leak style claims against Ukraine-linked targets. The most concrete, repeated OSINT references place «Смешарики» as a co-claimant with Perunswaroga in two separate narratives: (1) a claimed compromise of a Ukrainian service for veterans (December 2025) and (2) a claimed compromise of the Ukrainian DNA-testing clinic network MamaPapa (February 2026), including a stated large-volume data exfiltration claim and a public site notice attributing disruption to «Смешарики».
A critical analytic caveat is name collision: “Smeshariki/Смешарики” is also the name of a well-known Russian children’s cartoon brand. OSINT clearly uses the term as a hacktivist label in the incidents cited here, but defenders should avoid conflating unrelated entertainment channels or spam channels that reuse the same name.
Confidence is medium–high that «Смешарики» is an active brand used in pro‑Russia hacktivist claim ecosystems (multiple sources and cross-posts reference claims). Confidence is low–medium on the full scope of technical capability and the exact compromise method because publicly accessible victim-side telemetry is limited and the reporting is largely claim-driven.
IOC Appendix (TLP:WHITE) — SMESHARIKI HACKER GROUP
Note: Reviewed OSINT for SMESHARIKI HACKER GROUP is claim- and reporting-driven, with limited stable technical IOCs (hashes, dedicated C2). This appendix prioritizes behavioral indicators relevant to hack-and-leak operations and availability pressure.
