Threat Actor Characterization
Cardinal
ID: 6d16b8d48f82d9158ce26311d462cbba21819| Cardinal Hackers | CardinalHackers | MO***** | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
650b490a9fee62be9cf4c6c4c219d14400736 | BlackNet | Russia | ally-of | Hacktivist Group |
|
ec147a3b91d1df8973f96e8590e214a5 | inteid | Russia | ally-of | Hacktivist Group |
|
820801e74174d7ee8171bcad71d1529a83748 | Order403 | Unknown | ally-of | Hacktivist Group |
|
e43528293c95bdf4a1134830a40da6f662636 | Russian Legion | Russia | ally-of | Hacktivist Group |
|
c9028647e545317e00e20621edbf5df041153 | Russian Partizan | Russia | ally-of | Hacktivist Group |
|
863c949db9a48550778bf8f6099856aa18129 | White Pulse | Russia | ally-of | Hacktivist Group |
|
6510ee192f0b33ba10a9895a3aa93ba437033 | Z-INQUISITOR | Russia | member-of | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Cardinal is assessed as a Russia-aligned hacktivist brand associated with coalition-style DDoS disruption and coercive messaging, most visibly linked in public reporting to the 'Russian Legion' alliance and Denmark-focused threats in early 2026.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1498 | Network Denial of Service | TA0040 | |
| T1589.003 | Employee Names | TA0043 |
|
| T1595 | Active Scanning | TA0043 |
|
| T1583.006 | Web Services | TA0042 |
|
Cardinal — Pro-Russian Hacktivist Brand (DDoS-centric)
Classification: TLP: WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Hacktivism (Disruption) — Origin: Russia-aligned (assessed)
Author: Jorge Mieres [Principal Analyst]
Executive Summary
Cardinal is assessed as a Russia-aligned hacktivist brand primarily associated with denial-of-service (DDoS) disruption and public influence signaling. Recent public reporting describes Cardinal as a leading component of a newly announced hacktivist alliance branded “Russian Legion,” alongside The White Pulse, Russian Partizan, and Inteid, which issued threats and claimed disruptive activity tied to “OpDenmark” against Denmark in late January–February 2026.
Open reporting indicates the “Russian Legion” alliance was publicly announced on 2026-01-27 and issued a coercive political message on 2026-01-28 via Telegram, threatening escalation beyond DDoS if Denmark did not change policy within 48 hours. This behavior aligns with broader pro-Russian hacktivist patterns documented by government advisories: opportunistic, politically motivated disruption operations aimed at high-visibility public services and trust-critical websites.
Confidence for concrete organizational assertions is medium because public reporting is currently the primary basis and the “Cardinal” label is also used in unrelated contexts (e.g., historical malware naming). However, confidence is high that the cluster’s operational intent is disruption and signaling, based on repeated public threats and DDoS-centric framing in multiple independent reports.
