Cyber Threat Actor: People's Cyber Army

The threat actor referenced in the open sources consists of pro‑Russian hacktivist groups that have publicly claimed responsibility for a series of disruptive cyber operations against Ukrainian targets. One of the groups is explicitly identified as the “People’s Cyber Army,” which sources describe as Russian‑based hackers. Another grouping is referred to in the sources as the “Cyber Army group,” characterized in the reporting as pro‑Russia hackers who communicated their actions via Telegram. Both collectives have directed their activities toward Ukrainian entities, including the financial sector, media and industrial organizations, and the country’s nuclear energy infrastructure.

Their observed tactics involve large‑scale distributed denial‑of‑service attacks and website intrusions. In one incident the People’s Cyber Army reportedly used 7.25 million bot users to generate hundreds of millions of simulated page views against the Energoatom nuclear power company’s website, causing a three‑hour outage that did not significantly affect operations. In a separate episode, pro‑Russia hackers launched a DDoS attack against the Ukrainian mobile bank Monobank, delivering six million requests per minute according to the bank’s co‑founder. The Cyber Army group claimed via Telegram to have compromised the websites of the Lviv Chamber of Commerce and an Ukrainian armored vehicle producer, noting that those sites were later restored without reported incidents. Ukrainian cybersecurity officials have characterized most pro‑Kremlin cyberattacks on Ukraine as chaotic and poorly planned, noting that attackers first seek to gain access to information systems before deciding how to exploit them. These observed behaviors constitute the primary tactics, techniques and procedures publicly attributed to the actor.