Threat Actor Characterization
Silent Crow
ID: 5968220f513ceae1f0891cc8d9e7eade84195| SilentCrow | — | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Silent Crow — pro-Ukrainian hacktivist label publicly credited (with Belarusian Cyber Partisans) for the Aeroflot disruption on 28–29 July 2025; reporting cites months-to-year-long prepositioning, flight cancellations, and claims of extensive data theft and server destruction. Earlier 2025 items link Silent Crow to alleged breaches of Russian state/critical entities (e.g., Rosreestr, Rostelecom). Identity and structure remain opaque in open sources.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1498 | Network Denial of Service | TA0040 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 | |
| T1485 | Data Destruction | TA0040 | |
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 | |
| T1190 | Exploit Public-Facing Application | TA0001 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Silent Crow is a pro-Ukrainian hacktivist label publicly credited—jointly with the Belarusian Cyber Partisans (BCP)—for the Aeroflot cyber disruption on 28–29 July 2025. Independent coverage and official Russian acknowledgments describe dozens to 100+ flight cancellations, large-scale IT outages, and a criminal investigation. The groups’ statements claimed months-to-a-year of prepositioned access, exfiltration of sensitive data, and destruction of ~7,000 servers; several outlets repeated these points while noting the difficulty of immediate verification. Earlier reporting in January 2025 linked Silent Crow to alleged intrusions at Rosreestr and Rostelecom. The identity and internal structure of Silent Crow remain opaque, and some analysis suggests the name could be a pseudonym/banner rather than a stable organization. Overall, the public record supports credible disruptive impact at Aeroflot, with additional, partly unverified claims about depth of access and destruction. Confidence: medium-high for involvement in Aeroflot disruption; medium/low-to-medium for the broader capability set beyond the airline operation.
- 2025-01-09. Reporting links Silent Crow to a breach of Rosreestr; mentions prior claim involving Rostelecom (identity remains unclear; possible pseudonym theory). — The Record from Recorded Future
- 2025-07-28. Aeroflot disruption: Silent Crow + BCP claim responsibility; widespread cancellations reported; Russian authorities acknowledge a cyberattack and open a case. — Reuters
- 2025-07-29. Stabilization phase: Aeroflot reports operations largely returning to normal while dozens of flights remain canceled. — Reuters
- 2025-07-30. Aftermath analysis notes prior Silent Crow claims (Rosreestr/Rostelecom) and the group’s unknown identity. — Meduza
- 2025-08-01. Follow-on stories track purported data leak activity attributed to the attackers. — The Record from Recorded Future
