Hacktivist group

Morningstar

Origin: Russia Status: Active Confidence: Confirmed

Morningstar appears in limited open reporting as a small, loosely described hacktivist entity. The only clearly attributable public mention identified in the available OSINT for this profile is a brief claim that “Morningstar accessed random public CCTV cameras.” Beyond that single line, there is insufficient open reporting to confidently characterize membership, command structure, or consistent victimology.

INFERENCE (confidence: low): given the way the name appears alongside other ideologically motivated activity and the broader trend of pro‑Russian hacktivist ecosystems, Morningstar may be a transient alias used for opportunistic “visibility” actions (e.g., compromised CCTV access) rather than a stable, long-lived group with distinctive tradecraft.

Created by iQBlack CTI Team

Contributors 1

Last updated 2026-08-20

ATT&CK

MITRE ATT&CK

T1110Brute Force

T1133External Remote Services

T1498Network Denial of Service

T1595Active Scanning

Research

Selected OSINT

Morningstar: what an emerging and active actor reveals about the pro-Russian hacktivist ecosystemiQBlack Threat Intel Insight Morningstar Moves Under the Control of Z-Pentest AllianceiQBlack Threat Intel Insight Morningstar: full interview with an emerging actor in the pro-Russian hacktivist ecosystemiQBlack Threat Intel Insight Alert: Opportunistic Pro-Russia Hacktivists Attack U.S. and Global Critical InfrastructureCISA AA25-343A: Pro-Russia Hacktivists Conduct Opportunistic Attacks Against U.S. and Global Critical InfrastructureCISA