3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
UNIT 2012022023

UNIT 2012022023

ID: d237b8aaf8066c457e9b16aa35d7545d
Hacktivist Group Hacktivism
Threat types: Hacktivism, Data Leak, Political Campaigns, pro-Palestine
Russia BRA, IDN
Updated: 2026-02-13
Created: 2026-01-20
Progress: 67% Completeness: 65% Freshness: 70%
Operation zone: Brazil, Indonesia
Aliases Limited alias preview
No aliases registered.
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: low-medium
Actor Techniques page ATT&CK® Diagram

UNIT 2012022023 is an emergent hacktivist label that appears in late-2025 OSINT primarily through alliance announcements and shout-outs from other hacktivist groups, especially V For Vendetta Cyber Team (VFVCT). Public reporting describes UNIT 2012022023 and VFVCT as forming a new hacktivist alliance in October 2025 to strengthen politically motivated cyber operations, but there are no detailed, standalone incident reports tied uniquely to UNIT 2012022023. As of now, the actor is best understood as a secondary node within a broader hacktivist cluster rather than a fully profiled independent group.


Technique Technique name Tactics Evidence
T1585.001 Social Media Accounts TA0042
  • 2025-10-06 — INFERENCE (low confidence): A Dutch cybercrime bulletin reports that the hacktivist groups UNIT 2012022023 and V For Vendetta Cyber Team announced a new collaboration on 6 October 2025, explicitly classifying both as hacktivist actors. Modern hacktivist groups operating alliances and public 'ops' typically maintain branded social media or messaging accounts to publish claims and coordinate supporters; it is therefore likely that UNIT 2012022023 operates one or more such accounts even though specific handles are not yet visible in open sources. · ref
  • 2025-10-20 — INFERENCE (low confidence): A broader cyber-threat journal summarising hacktivist developments notes that UNIT 2012022023 and V For Vendetta Cyber Team have publicly announced cooperation to strengthen political cyber operations. This kind of coordinated hacktivism almost always uses Telegram channels, X accounts, or similar social platforms for recruitment and propaganda, supporting the assessment that UNIT 2012022023 relies on established social media accounts as part of its operational presence. · ref
T1585.003 Cloud Accounts TA0042
  • 2025-10-06 — INFERENCE (low confidence): Reporting on the new hacktivist alliance between UNIT 2012022023 and V For Vendetta Cyber Team frames both as groups that conduct digital attacks for political objectives. Within this ecosystem, allied actors commonly maintain defacement galleries, paste sites, or simple blogs to host operation banners and victim lists. While no direct UNIT 2012022023 website has yet been identified in OSINT, it is plausible that the group uses one or more web presences (or shared sites with its allies) to support propaganda and leak publication. · ref
T1491.002 External Defacement TA0040
  • 2025-10-09 — INFERENCE (low confidence): In a post on the 'V FOR VENDETTA CYBER TEAM backup' Telegram channel, VFVCT claims to have compromised the data of over 200,000 Brazilian radio users and publishes a 'special thanks' list naming multiple allied hacktivist teams, including UNIT 2012022023, in the context of that operation. The campaign is clearly framed as a protest action with public messaging, and VFVCT is otherwise documented as performing defacements and public leak-style influence operations. UNIT 2012022023’s inclusion in this alliance claim suggests participation in, or at least co-branding of, such defacement/leak campaigns, but the exact operational role remains unclear. · ref
Strategic Intelligence
Limited preview
Last updated: 2026-01-22T02:16:11+00:00

UNIT 2012022023 — Preliminary Intelligence

Classification: TLP:WHITE)

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Saved Limited preview

Executive Analyst Brief for CISO — UNIT 2012022023

Actor type: Emerging hacktivist label (cluster member, not a fully profiled standalone group)

Upgrade to access the full executive brief.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Empty Limited preview
No content yet.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Empty Limited preview
No content yet.
IOC Appendix now
Saved successfully.
OSINT Library
Empty Limited preview
No content yet.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/1
Address Verification SOCMINT
t.me/UNI*********** Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
Showing 1–2 of 2 images
Alliance with V For Vendetta Cyber Team Free Preview
Alliance with V For Vendetta Cyber Team
Imagen used in Telegram account Free Preview
Imagen used in Telegram account