Threat Actor Characterization
Narodnaya CyberArmiya
ID: 6c787c3b8f5c8385213bd014e9367e3355667| C.A.R.R. | CARR | Ci******************* | Cy****************** |
| Cy************************* | Cy********************** | Cy***************** | Cy********************** |
| Na****************** | N** | Pe***************** | th********************* |
| Th******************************* | На***************** | На************************* | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
4c05b1e5e29d9d8b9d060a33399e271c | CyberDragon | Unknown | ally-of | Hacktivist Group |
|
bc0dc0b7ded7bd81aef1307a1d7350af78029 | Degtyarenko | Russia | member-of | Cybercrime |
|
6467d88491553c77b3bd09c424627e5368291 | error_404_smoke | Russia | member-of | Cybercrime |
|
2351a5d9cf5d5b7183400840e36e37b282707 | KillMilk | Russia | related | Cybercrime |
|
78dd1c3c3dfc6fcbbda95d743ab0e2f732121 | NoName057(16) | Russia | ally-of | Hacktivist Group |
|
ee7c9196a35cc624774e641bf7962efc | OverFlame | Russia | ally-of | Hacktivist Group |
|
958a59d20a43b9f22f914bc556fb14f439035 | Pankratova | Russia | member-of | Cybercrime |
|
fe9a74adcf33cbcff8ce1ce59ccc597a29517 | Sector16 | Russia | ally-of | Hacktivist Group |
|
ba0e9ae91ba1b9b5b915d1d4b147736311264 | SKILLNET | Russia | ally-of | Hacktivist Group |
|
131885bdee7830a7b8da4526fc33b96895956 | UserSec | Russia | affiliated | Hacktivist Group |
|
6510ee192f0b33ba10a9895a3aa93ba437033 | Z-INQUISITOR | Russia | ally-of | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Narodnaya CyberArmiya (People’s Cyber Army / CARR) — pro-Russia hacktivist label specializing in Telegram-coordinated DDoS against Ukraine and pro-Ukraine states. Public records show target call-outs followed by website outages; U.S. Treasury (July 19, 2024) sanctioned two leaders, describing the group as government-aligned. Capability: low–moderate technically, high in tempo and publicity.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1498 | Network Denial of Service | TA0040 |
|
| T1585 | Establish Accounts | TA0042 |
|
| T1102 | Web Service | TA0011 |
|
| T1589 | Gather Victim Identity Information | TA0043 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Narodnaya CyberArmiya (Народная CyberАрмия) — often branded in English as the People’s Cyber Army or Cyber Army of Russia Reborn (CARR) — is a prominent pro-Russia hacktivist label active since early 2022, specializing in high-tempo DDoS and propaganda operations against Ukraine and pro-Ukraine states. Public reporting and advisories describe the group’s Telegram-centric tasking model, political targeting, and repeated call-outs that precede attacks on media and public portals. In July 2024, the U.S. Treasury sanctioned two named leaders, framing the entity as government-aligned; analysts and regulators continue to debate the boundary between state enablement and “hacktivism.” Overall capability: low–moderate technically (L7/L4 floods, botnets, open proxies), high in tempo and publicity, with demonstrated cross-campaign influence effects. Confidence: high
- Brand & naming. The label appears as Narodnaya CyberArmiya / People’s Cyber Army, and widely as Cyber Army of Russia Reborn (CARR) in sanctions and vendor profiles. Telegram posts frame political motives (retaliation for pro-Ukraine stances) and call for crowd participation
- Positioning. Multiple sources profile CARR as a prominent hacktivist outfit conducting disruptive campaigns; narratives oscillate between “grassroots” and state-aligned depending on the source.
- Objectives. Availability disruption for narrative/psychological effect, timed to news cycles (sanctions, elections, battlefield events). Telegram broadcasts name the target, then the attack follows (media outlets note the causality).
- Influence model. Public claims, scoreboard-style proofs (uptime checks), and coalition amplification with other pro-Russia banners. INFERENCE (medium) from ecosystem reporting.
IOC Appendix (TLP:WHITE) — Cyber Army Russia Reborn (CARR)
Important: CARR activity is frequently opportunistic and may not reuse stable infrastructure. Many “indicators” are behavioral (exposure patterns) rather than durable hashes/domains.
