Cyber Threat Actor: XakNet

XakNet is a Russian-speaking hacking group that emerged in March 2022, according to US and allied government advisories. The group publicly operates under this single alias and has primarily targeted Ukrainian entities in support of Russia’s military actions. Its most documented operation occurred in July 2022 against DTEK Group, Ukraine’s largest private energy conglomerate, which owns coal and thermal power plants across the country. The attack aimed to destabilize technological processes at energy distribution facilities, spread propaganda about company operations, and disrupt electricity supply to Ukrainian consumers. This targeting aligns with historical Russian cyber campaigns against Ukraine’s critical energy infrastructure dating back to 2014, though XakNet’s specific involvement in prior incidents remains unspecified.

The group employs network breaches followed by data exfiltration and leaks through Telegram channels, where it publicly posted screenshots of compromised DTEK information. Analysts from cybersecurity firm Mandiant identified potential links between XakNet and Russian state-sponsored cyber espionage groups, citing the hackers’ access to data previously compromised by known government-affiliated actors. XakNet has repeatedly denied any official affiliation with Russian authorities on its Telegram platform. The DTEK intrusion coincided with physical strikes on the company’s thermal power plant in Kryvyi Rih, reflecting a documented pattern of Russian-aligned operations combining cyber and kinetic attacks against Ukrainian energy targets. While XakNet claimed responsibility for breaching DTEK’s systems, the company confirmed no operational disruptions occurred. The group has also targeted Ukrainian government officials since its emergence, maintaining a consistent focus on entities opposing Russia’s invasion.