Threat Actor Characterization
РУБЕЖ
ID: 1a4a1db4c07d0dc3f48f8fcc186b61f340140| Frontier | RUBEZH | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
РУБЕЖ (Frontier) is a Telegram-centric pro‑Russia entity combining claim-driven disruption narratives (DDoS-style 'cyberstrike' posts with third-party status links) with operation and monetization of a paid OSINT bot (@FireRaize_bot) offering API access and identity lookup/enrichment features (including name + birthdate searches and 'private database' additions). Evidence strongly supports social-platform coordination/propaganda and the existence/maintenance of the bot service. DDoS impacts are claim-driven and should be validated with telemetry. Identity data collection/enrichment is modeled as an enablement capability based on advertised features.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1585.001 | Social Media Accounts | TA0042 | |
| T1498 | Network Denial of Service | TA0040 |
|
| T1589 | Gather Victim Identity Information | TA0043 |
|
РУБЕЖ (Frontier) — Pro‑Russia Telegram Hacktivist/OSINT Team (DDoS Claims + Paid OSINT Bot)
Classification: TLP: WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Hybrid — Hacktivist-style disruption claims + data-enrichment / doxxing‑adjacent OSINT service
Assessed home base: Unclear; TGStat metadata indicates Russia/Russian audience context for the channel
Executive Summary
РУБЕЖ (“Frontier”) is a Telegram‑centric entity that combines two observable behaviors in open sources: (1) pro‑Russia, war‑framed “cyberstrike” claim posts (primarily DDoS‑style disruption claims with check-host status links), and (2) promotion and operation of a paid “OSINT bot” project named @FireRaize_bot, including API access, subscription mechanisms (Telegram Stars), and frequent announcements of new database ingestion and feature upgrades.
In February 2026, posts attributed to the channel claim a joint “точечный киберудар” (targeted cyber strike) with “Богатырская Застава,” naming two Ukrainian‑linked targets and providing check-host reports. These posts explicitly use pro‑war slogans and hashtags consistent with pro‑Russia ideological framing (#КиберФронтZ, #Z, #СвоихНеБросаем).
Separately, multiple channel posts describe the OSINT bot’s technical upgrades and database additions, including “private databases” and the ability to search by name + date of birth (FIO + bdate), implying a doxxing‑adjacent data‑enrichment capability. This introduces a dual risk: (a) availability disruption claims against external targets, and (b) privacy/identity data misuse risk via the service’s advertised functionality.
IOC Appendix (TLP:WHITE) — РУБЕЖ (Frontier)
Note: Reviewed OSINT does not provide stable malware hashes or dedicated C2 infrastructure for РУБЕЖ (Frontier). This appendix focuses on correlation cues and behavioral indicators for disruption and identity-data misuse.