Threat Actor Characterization
Russian Partizan
ID: c9028647e545317e00e20621edbf5df041153| PARTISAN | Russian Partisan | Ru************* | Ru************* |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
6d16b8d48f82d9158ce26311d462cbba21819 | Cardinal | Russia | ally-of | Hacktivist Group |
|
14d8f4bd1aa8745de9216240a85e2b4516417 | Hackhax | Russia | ally-of | Hacktivist Group |
|
5c6b35ea1356a1168397df22c30e7b2072268 | HARM Alliance | Russia | ally-of | Hacktivist Group |
|
ec147a3b91d1df8973f96e8590e214a5 | inteid | Russia | ally-of | Hacktivist Group |
|
e43528293c95bdf4a1134830a40da6f662636 | Russian Legion | Russia | ally-of | Hacktivist Group |
|
863c949db9a48550778bf8f6099856aa18129 | White Pulse | Russia | ally-of | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Russian Partizan is a pro-Russian hacktivist label associated in public reporting with campaign-based disruptive operations, especially DDoS, and coalition activity within the ‘Russian Legion’/‘OpDenmark’ narrative in early 2026.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1498 | Network Denial of Service | TA0040 |
|
| T1499 | Endpoint Denial of Service | TA0040 |
|
| T1595 | Active Scanning | TA0043 |
|
Russian Partizan — Pro-Russian hacktivist collective
Classification: TLP: WHITE - Open Source Intelligence (OSINT)
Category: Hacktivism / Politically motivated disruption — Origin: INFERENCE (confidence: medium): Russia-aligned / Russian-language ecosystem
Author: iQBlack CTI Team
Executive Summary
Russian Partizan is assessed as a pro-Russian hacktivist brand primarily associated with disruptive operations (notably DDoS) and information operations in support of Russian geopolitical narratives. Public reporting in early 2026 places Russian Partizan as a member of the “Russian Legion” alliance alongside Cardinal, The White Pulse, and Inteid, which publicly threatened Denmark under the campaign label “OpDenmark”.
The publicly described operational pattern is consistent with campaign-driven hacktivism: public warnings/ultimatums communicated via social channels, followed by bursts of disruptive activity against public-facing services. This model is optimized for visibility and political signaling rather than stealth, persistent access, or high-end cyber-espionage tradecraft.
Open sources reviewed for this deliverable do not provide reliable, stable infrastructure indicators (domains/C2) attributable to Russian Partizan. As a result, defender value comes primarily from behavioral detection (DDoS precursors, anomalous traffic patterns) and OSINT early warning (monitoring alliance messaging and claimed target lists).
