Threat Actor Characterization
inteid
ID: ec147a3b91d1df8973f96e8590e214a5Actor Network Graph
Open Network GraphMITRE ATT&CK®
Inteid is assessed as a pro-Russian hacktivist brand associated with DDoS-centric disruption and coercive messaging. Public reporting (Truesec) lists Inteid as a member of the 'Russian Legion' alliance targeting Denmark under 'OpDenmark' and notes Inteid conducted a DDoS attack against Denmark’s health portal sundhed.dk in late January 2026. Danish sector reporting indicates 'inteid' claimed responsibility for a DDoS outage affecting sundhed.dk. Evidence supports DDoS impact; steps such as scanning and bot capacity are marked as INFERENCE.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1498 | Network Denial of Service | TA0040 |
|
| T1589.003 | Employee Names | TA0043 |
|
| T1595 | Active Scanning | TA0043 |
|
| T1583.006 | Web Services | TA0042 |
|
Inteid — Pro-Russian Hacktivist Brand (DDoS-centric; Russian Legion member)
Classification: TLP: WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Hacktivism (Disruption & Coercive Messaging)
Executive Summary
Inteid is assessed as a pro-Russian hacktivist brand primarily associated with denial-of-service disruption and public influence signaling. In late January–early February 2026, multiple independent sources describe Inteid as a member of the newly announced hacktivist alliance “Russian Legion,” alongside Cardinal, The White Pulse, and Russian Partizan, under the campaign name “OpDenmark.”
Truesec reporting states Inteid conducted a DDoS attack against Denmark’s health portal sundhed.dk “earlier this week” (relative to 2026-01-30), and a Danish sector outlet reports that the hacker group “inteid” claimed responsibility for a DDoS outage affecting sundhed.dk.
Truesec further observed that while Russian Legion messaging claims more advanced capability, the observed campaign to date has consisted only of DDoS attacks; it also noted “Phase 2” (“Operation Ragnarök”) and potential spillover targeting beyond Denmark.
IOC Appendix (TLP:WHITE) — Inteid
Note: For Inteid, reviewed open sources emphasize DDoS disruption and public threats and do not provide stable, high-fidelity technical indicators (e.g., malware hashes, dedicated C2 domains). This appendix therefore focuses on behavioral indicators, early-warning cues, and scoping references.
Free Preview
Free Preview
Free Preview
Free Preview
Free Preview
Free Preview