Threat Actor Characterization
Molot Team
ID: b0f30e9e306cf2b21592b5d62555973402636| Molot | molotTeam | М.****************** | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
71baa6e296e685bb269cd958f3fd86a599046 | Anonymous Russia | Russia | affiliated | Hacktivist Group |
|
c925e2ca06cf9a92a6b10007eb227c7339550 | Cyber Voyskaare | Russia | affiliated | Hacktivist Group |
|
5bdc43b396660424f321fa796614a9f726437 | Keymous Team | Algeria | affiliated | Hacktivist Group |
|
ee7c9196a35cc624774e641bf7962efc | OverFlame | Russia | ally-of | Hacktivist Group |
|
ed81ecd50a7532f06fc43e13ce45964224872 | StillNet | Russia | affiliated | Hacktivist Group |
|
035031254758b51f853749465e75b07196207 | TwoNet | Russia | affiliated | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Molot Team (often stylized M.O.L.O.T./М.О.Л.О.Т.) is a pro‑Russia Telegram hacktivist brand observed in monitoring and indexing sources. The actor is linked to coalition alliance messaging (e.g., StillNet) and to claim-driven narratives including alleged access to industrial control panels. Because actor-specific technical telemetry is limited, ATT&CK mapping is conservative and anchored to the repeatable ecosystem technique described in late‑2025 government advisories: opportunistic abuse of exposed remote access (VNC) against critical infrastructure, alongside disruption (DDoS) and social-platform claim amplification. Data-theft claims (Kyiv orders) are treated as low-confidence and used only as intent signals.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1498 | Network Denial of Service | TA0040 |
|
| T1585.001 | Social Media Accounts | TA0042 |
|
| T1021.005 | VNC | TA0008 |
|
| T1133 | External Remote Services | TA0001 TA0003 |
|
| T1567 | Exfiltration Over Web Service | TA0010 |
|
Molot Team — Pro‑Russia Telegram Hacktivist Brand (DDoS + ICS/OT Access Claims; Coalition Alliances)
Classification: TLP: WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Hybrid — Disruption (DDoS) + opportunistic remote access claims (ICS/OT); propaganda/claims via Telegram
Assessed home base: INFERENCE: Russia‑aligned ecosystem (confidence: medium); exact geography unknown
Executive Summary
Molot Team is assessed as a pro‑Russia hacktivist brand operating in Telegram‑amplified ecosystems, commonly represented with the stylized label “М.О.Л.О.Т.” (M.O.L.O.T.). Open sources reviewed for this deliverable are largely claim-driven and index/monitoring-led, but they consistently indicate coalition behavior: alliance announcements with other Telegram hacktivist brands (e.g., StillNet) and repost/forward dynamics.
The most operationally relevant aspect is a set of claims (via Telegram indexing snippets and monitoring posts) describing access to industrial equipment control panels (Italy cited in a post excerpt) and the broader ecosystem trend of opportunistic abuse of exposed remote access (VNC) to affect critical infrastructure. Government and partner advisories in late 2025 describe that pro‑Russia hacktivists leverage widely exposed VNC endpoints to execute opportunistic attacks against critical infrastructure; this provides a strong baseline for how Molot Team’s claimed behaviors should be defended against, even where actor-specific telemetry is absent.
One low-reliability OSINT digest item also reports a claim that Molot Team stole 1500+ “secret orders” from Kyiv’s military administration (document theft claim). Given the sourcing and lack of independent corroboration, this is treated as an unverified claim and used only to inform hypothesis and collection priorities.
IOC Appendix (TLP:WHITE) — Molot Team
Note: Reviewed OSINT provides limited stable technical indicators uniquely attributable to Molot Team. The most actionable indicators are behavioral, especially around exposed remote access (VNC) and DDoS patterns.
Free Preview
Free Preview
Free Preview
Free Preview
Free Preview