Executive Summary

On 27 May 2026, a statement was disseminated announcing the union between Earthimpact, Z-Alliance and AlfaNet, three actors presented within the pro-Russian hacktivist ecosystem with apparently complementary functions.

According to the message, Earthimpact would be oriented toward compromising video surveillance, SCADA systems and industrial networks in Ukraine; Z-Alliance is presented as an actor focused on direct action against critical infrastructure and industrial systems; and AlfaNet is once again positioned as a cyberintelligence unit dedicated to passive collection, network assets, government/military documents and strategically valuable information, reinforcing the trend already observed regarding its accelerated search for alliances with actors of greater operational exposure.

Key Judgments

• Earthimpact, Z-Alliance and AlfaNet announced a union on 27 May 2026.
• The statement presents Earthimpact as an emerging actor specialized in cameras, SCADA, industrial video surveillance and intelligence derived from video.
• Z-Alliance appears as the component with the strongest operational orientation toward SCADA and critical infrastructure.
• AlfaNet is once again presented as a cyberintelligence actor focused on passive collection and government/military information.
• The union reinforces the hypothesis of a collaborative structure based on complementary functions.

What Happened

A statement published under the title “Union of Groups” announced the union of Earthimpact, Z-Alliance and AlfaNet.

The message describes Earthimpact as a new group that emerged on 3 May and attributes to it activity against more than 800 video surveillance cameras in Ukrainian territory, including geolocation of part of those accesses and association with specific objects observed in the images. It also attributes to Earthimpact a specialization in SCADA, industrial video surveillance networks and intelligence collection through the compromise of video streams.

Z-Alliance is presented as “the People’s Cyber Army of Russia,” focused on attacks against industrial infrastructure, SCADA systems and critical infrastructure assets. The statement also mentions alleged previous actions against targets in the United States and Israel.

AlfaNet is described as a pro-Russian cyberintelligence unit, without major independent operations attributed to it in the statement, but focused on passive asset collection, acquisition of government and military documents, and intelligence production. This description is consistent with the positioning AlfaNet has been trying to build in its recent publications.

Operational Assessment

Visual intelligence, technical intelligence and operational action against infrastructure are the three layers this public alliance appears to be trying to cover.

The union exposes a functional division logic, where Earthimpact would contribute visual access, cameras, video surveillance, geolocation and intelligence derived from observation. In a context such as Ukraine, that type of information can have tactical value if it allows the observation of facilities, movements, routines, physical points or exposed assets.

Z-Alliance would contribute the narrative and direct-action profile against SCADA and critical infrastructure. Its inclusion helps give the statement a more offensive weight, especially in the OT/ICS dimension.

AlfaNet would contribute the upstream intelligence layer: network assets, information correlation, documents, passive reconnaissance and strategic reading of targets. This again reinforces its role as analytical support within pro-Russian hacktivist alliances.

Intelligence Significance

For AlfaNet tracking, this publication is especially valuable because, in a short period of time, the actor moved from presenting itself as an OSINT/cyberintelligence unit to associating with Z-Pentest, Void Hackers, NoName057(16), Axis of Resistance Legion and now Earthimpact and Z-Alliance.

The pattern around AlfaNet is now very clear: it is trying to consolidate itself as an intelligence node within an ecosystem where other actors contribute execution, propaganda, access, intrusion or operational pressure.

The Earthimpact case adds an interesting dimension through the exploitation of cameras and video surveillance as a source of intelligence. If the declared activity were real, it could provide information with tactical or propagandistic value, especially in a conflict where remote observation of infrastructure, routes, buildings or facilities can feed later decisions.

Analytical Closing

The declared union between Earthimpact, Z-Alliance and AlfaNet still does not confirm joint operations or validate all actions mentioned in the statement, but it does reinforce the fact that these actors are trying to project a collaborative chain where upstream intelligence, technical observation and action against critical infrastructure are presented as complementary functions.

Under this scenario, AlfaNet once again occupies the most relevant role for monitoring as a provider of information, reconnaissance and analytical support for actors with greater operational exposure.