Cyber Threat Actor: UserSec

UserSec is a pro‑Russia hacking group that operates under the alias UserSec and is known to be based in Russia. The group has been linked to the broader Anonymous Russia collective, with which it shares affiliations and occasional joint claims of responsibility. Public sources describe UserSec as ideologically motivated rather than financially driven, aligning with the broader narrative of Russian‑linked actors targeting perceived adversaries. The group’s known activity centers on disrupting online services through distributed denial‑of‑service attacks, a tactic explicitly referenced in the incidents attributed to it.

UserSec’s targeting has focused on United Kingdom aviation infrastructure, specifically the public‑facing websites of airports. In July 2023 the group claimed responsibility for an outage at London City Airport’s website, and in October 2023 it claimed a DDoS attack against Manchester Airport’s website, announcing a broader campaign against UK airports that also included a claim regarding Birmingham Airport made by its affiliate Anonymous Russia. These actions were intended to cause disruption, as the attackers described overwhelming the sites with traffic until they became inaccessible, although flight operations and passenger services were reported to remain unaffected.

The tactics observed in UserSec’s operations involve flooding target web servers with traffic to deny legitimate users access, a method that does not appear to rely on malware families, specific initial access vectors, or bespoke tooling beyond standard DDoS capabilities. No evidence of data exfiltration, espionage, or financial gain has been presented in the reported incidents. Attribution to UserSec rests on the group’s own public claims and the timing of the outages, with the National Cyber Security Centre investigating the Manchester Airport incident and airport IT teams examining the London City Airport event. While the group’s exact size, internal structure, or sponsorship remains unspecified in the available material, its repeated assertions of pro‑Russian motivation and its coordination with Anonymous Russia provide the clearest picture of its affiliations and operational focus.