Classification: Unclassified / Open Source Intelligence (OSINT)

Category: Cybercrime / Hacktivism — Origin: Ukraine-aligned (pro-Ukraine ecosystem)

Author: iQBlack CTI Team

Executive Summary

Cyber.Anarchy.Squad (C.A.S) is a pro-Ukraine hacktivist collective active since 2022, conducting destructive and data-leak operations primarily against Russia and Belarus. Public technical reporting (Kaspersky Securelist, 2024-12-18) documents C.A.S campaigns abusing public-facing application vulnerabilities (e.g., Jira, Confluence, MS-SQL) and deploying uncommon RATs (Revenge RAT, Spark RAT) and Meterpreter for post-exploitation. Victimology spans government, telecom, tech, and industrial firms in Russia/Belarus. C.A.S activity includes high-impact disruptions and data destruction, such as the Avanpost (Avanpost/Avapost) breach (2024-07) and Infotel JSC service disruption (2023-06), both publicly acknowledged by victims/media. C.A.S communicates on Telegram, posts claims/evidence, and has links to other pro-Ukraine groups (Ukrainian Cyber Alliance—UCA, RUH8, RM-RF), with cross-group operational collaboration noted. Overall, C.A.S’s capability to rapidly weaponize Internet-exposed services, leverage commodity+rare tools, and coordinate claims places it among the more operationally consequential hacktivist actors in the RU/UA conflict space. Confidence: high for targeting, tooling, and campaign facts; medium for internal membership structure.

• Industries / Sectors: Government ministries and agencies; telecommunications; financial/banking infrastructure enablers; technology/entertainment; industrial enterprises.
• Geography (Region): Primarily Russia and Belarus; opportunistic RU-linked providers.
• Timeframe: 2022–present; notable peaks in 2023–2025.