Threat Actor Characterization
Eye Of Sauron
ID: e6ada4fb02f00af85a4f427e84b4108d04917| Sauron Of Eye | — | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Eye Of Sauron is a pro‑Russia Telegram hacktivist brand referenced in OSINT primarily via claim-driven narratives, notably the alleged compromise/disruption of the Ukrainian military messaging system 'Sonata' (often co-claimed with PalachPro). The open record reviewed is heavy on claims and secondary reporting; therefore ATT&CK mapping is conservative, emphasizing denial-of-service and use of social platforms for coordination/propaganda. Exposed-service/credential abuse is included as INFERENCE where not directly evidenced.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1585.001 | Social Media Accounts | TA0042 | |
| T1498 | Network Denial of Service | TA0040 | |
| T1133 | External Remote Services | TA0001 TA0003 |
|
| T1595 | Active Scanning | TA0043 |
|
Eye Of Sauron — Pro‑Russia Telegram Hacktivist Brand (Claims of Compromising Ukrainian Military Messaging)
Classification: TLP: WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Hybrid — Hacktivism (disruption + access claims) with Telegram‑amplified propaganda
Assessed home base: INFERENCE: Russia‑aligned ecosystem (confidence: medium); exact geography unknown
Executive Summary
Eye Of Sauron is a Telegram-centric pro‑Russia hacktivist brand that appears in OSINT primarily through claims and repost-driven narratives. The most prominent set of claims ties the group (often alongside PalachPro) to the alleged compromise and/or disruption of “Sonata” / “Sonata Messenger,” described in reporting as a messaging system used by Ukrainian military personnel.
A Telegram indexing archive (Telemetr) for the channel “EYE OF SAURON” includes posts framing the activity as a targeted operation and asserting access to an active account of the service, which the group uses to dispute claims that the platform is secure. Additional reporting (often citing Russian Telegram sources) repeats the same narrative and extends it to other claimed targets, including Ukrainian port-related infrastructure.
Because much of the publicly visible record is claim-driven and relies on secondary reporting, confidence is highest in the actor’s existence and propaganda/claim posture, and lower regarding the true operational impact (service-level disruption vs. confirmed system compromise). This profile treats the Sonata narrative as an intent and targeting indicator and emphasizes defender controls aligned to high-probability tactics: exposed service abuse, credential compromise, and disruption operations in campaign windows.
IOC Appendix (TLP:WHITE) — Eye Of Sauron
Note: Reviewed OSINT provides limited stable malware/C2 indicators for Eye Of Sauron. This appendix prioritizes behavioral indicators and correlation cues suitable for disruption and exposed-service abuse campaigns.
