Threat Actor Characterization
SoubearArmy
ID: a51ebeeee9fccf528ada17b7db5c10fdRelated profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
|
e1f46b8cbf7c9c514048ed97dacf7a6b93073 | 22C | Russia | ally-of | Hacktivist Group |
|
|
4c05b1e5e29d9d8b9d060a33399e271c | CyberDragon | Unknown | ally-of | Hacktivist Group |
|
5220f70b399cf82f36d3fc3114e0535a | Horus Team | Russia | ally-of | Hacktivist Group |
|
|
13031d55484c6c539a6562cc5e730a75 | PHOENIX | Unknown | ally-of | Hacktivist Group |
|
131885bdee7830a7b8da4526fc33b96895956 | UserSec | Russia | ally-of | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
SoubearArmy is a hacktivist brand label reported as part of a pro-Russian DDoS alliance linked to the NoName057(16)/DDoSia ecosystem, with activity expressed primarily as disruptive DDoS campaigns against public-facing services (availability impact) rather than covert intrusion.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1498 | Network Denial of Service | TA0040 |
|
| T1071.001 | Web Protocols | TA0011 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1595 | Active Scanning | TA0043 |
|
SoubearArmy — Pro-Russian-aligned hacktivist brand linked to DDoS “alliance” activity
Classification: TLP:WHITE — Open Source Intelligence (OSINT)
Category: Hacktivism / Crowd-enabled DDoS (cluster-level association) - Origin: Russia-aligned ecosystem (INFERENCE, confidence: medium)
Author: iQBlack CTI Team
Executive Summary
SoubearArmy appears in public reporting primarily as one of several hacktivist “ally” brands publicly aligned with the pro‑Russian DDoS ecosystem centered on NoName057(16) and its crowdsourced DDoS tooling (“DDoSia”). Public reporting describes an “alliance” including SoubearArmy and other groups, notably connected to attacks against Italian infrastructure, but provides limited independent, actor‑unique technical artifacts directly attributable to SoubearArmy.
Given the available OSINT, the most defensible analytic stance is to treat SoubearArmy as a label within a broader pro‑Russian hacktivist coalition rather than as a fully distinct intrusion set with unique tooling. Where activity is observed, it is most plausibly expressed through commodity DDoS operations (HTTP floods and related volumetric methods) and/or participation in shared “call‑to‑action” targeting cycles published via Telegram channels affiliated with the wider ecosystem.
Confidence in the coalition linkage is medium (reported “alliance” announcements in multiple sources). Confidence in any specific, independent SoubearArmy infrastructure or bespoke tooling is low due to a lack of uniquely attributable indicators in open reporting. Analysts should therefore model SoubearArmy as a campaign tag for coalition activity and track it as part of NoName057(16)/DDoSia‑style operations, with conservative attribution.