Threat Actor Characterization
QuietSec
ID: add05055fdb508b8a57823b9b39d899e97176| QuietSecurity | — | — | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
e2944d854abc4282bfe8029f4664a44f97533 | Cyber Raw Bangladesh | Bangladesh | ally-of | Hacktivist Group |
|
5c6b35ea1356a1168397df22c30e7b2072268 | HARM Alliance | Russia | ally-of | Hacktivist Group |
|
5bdc43b396660424f321fa796614a9f726437 | Keymous Team | Algeria | ally-of | Hacktivist Group |
|
820801e74174d7ee8171bcad71d1529a83748 | Order403 | Unknown | related | Hacktivist Group |
|
6d26bbae56be178a7f3e3e8dc365b53774013 | PerunSwaroga | Russia | ally-of | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
QuietSec is a Telegram-based amplifier/aggregator that reposts and disseminates claim narratives from pro‑Russia hacktivist and leak actors (e.g., PerunSwaroga and «Смешarики»). The reviewed open record supports its role in social-platform coordination/propaganda and narrative acceleration rather than direct technical execution. ATT&CK mapping is therefore minimal and focuses on social media use; any disruption or intrusion techniques should be mapped to the original claiming operators unless direct evidence ties QuietSec to execution. Additional OSINT indicates QuietSec has also posted or amplified DDoS claims against resources associated with Ukraine, France, and Denmark via its official Telegram presence; these are treated as claim-based signals and should be validated with telemetry.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1585.001 | Social Media Accounts | TA0042 | |
| T1498 | Network Denial of Service | TA0040 |
|
QuietSec — Pro‑Russia Telegram Aggregator/Amplifier (Repost Hub for Hacktivist Claims)
Classification: TLP: WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Hybrid — Propaganda & claim amplification; ecosystem signal node (not a confirmed standalone operator)
Assessed home base: INFERENCE: Russia‑aligned Telegram ecosystem (confidence: medium)
Executive Summary
QuietSec is assessed as a Telegram-centric amplifier/aggregator that curates and reposts content from pro‑Russia hacktivist and leak/disruption brands. Open indexing and post archives show QuietSec forwarding and quoting narratives linked to actors such as PerunSwaroga and «Смешарики», including “hack-and-leak” and disruption claim content.
The operational significance of QuietSec is its role as an ecosystem signal node: it increases reach, shortens propagation time of “operations” narratives, and can serve as an early-warning pivot for emerging targeting waves. Because the channel’s most evidenced function is reposting/curation, this profile treats QuietSec primarily as a distribution hub rather than a clearly defined actor executing attacks.
Confidence is high that QuietSec exists and functions as a repost/aggregation channel. Confidence is low–medium that QuietSec itself executes technical operations (insufficient direct evidence in reviewed sources). However, its amplification role can materially increase reputational and operational impact during campaign windows.
IOC Appendix (TLP:WHITE) — QuietSec
Note: QuietSec is evidenced primarily as a repost hub; stable malware/C2 indicators are not attributable from reviewed OSINT. This appendix focuses on correlation cues and behavioral indicators relevant to amplified campaigns.
