Z-INQUISITOR

Z-INQUISITOR appears in open sources primarily as a Telegram-branded hacktivist persona/channel operating within the broader pro-Russia hacktivist ecosystem. Public-facing content attributed to this brand emphasizes ideological messaging and alliance signaling, including claims (via third-party channel indexing) of joining a “Russia Legion” alliance.

Unlike mature ransomware or APT clusters, the observable footprint for Z-INQUISITOR is heavily “social-first”: narrative amplification, target naming, and public claims are more visible than stable infrastructure (C2 domains, malware families, or repeatable operator tooling). This pattern is consistent with wider pro-Russia hacktivist dynamics described in late-2025 government reporting, where actors frequently self-attribute and exaggerate impacts to gain notoriety.

Attribution for specific intrusions or disruptions to Z-INQUISITOR alone remains weak in OSINT reviewed for this deliverable. The most defensible assessment is that Z-INQUISITOR is a minor-to-mid tier brand aligned with pro-Russia hacktivist coalitions (INFERENCE) and may participate in, or amplify, opportunistic disruption campaigns (DDoS/defacement narratives) commonly associated with that ecosystem.

Confidence: Medium for ecosystem alignment and comms posture; Low-to-Medium for actor-specific technical TTP claims beyond publicly visible messaging.