Cyber Threat Actor: Meowless

Meowless is the alias used by a threat actor that has been publicly linked to a cyber incident targeting a Romanian governmental website. Open‑source reporting indicates that the actor is believed to operate from Russia, although no further details about their infrastructure or operational base have been confirmed. The name Meowless appears only in connection with the specific defacement and ransom demand described in the available article, and no other aliases or associated identifiers have been disclosed in public sources.

The actor’s known activity involved the Cluj County Council’s website, which is a public administration entity located in Cluj County, Romania. This targeting demonstrates a focus on local government institutions within Eastern Europe, specifically a municipal council that provides public services to the region. The actors’ communication with the victim included a clear demand for monetary compensation, requesting the sum of one hundred United States dollars in Bitcoin to prevent the release of encrypted files. This demand indicates that the immediate objective of the operation was financial extortion rather than espionage or purely disruptive aims.

The tactics observed in this incident consisted of website defacement accompanied by a message asserting that all files had been encrypted and a backup copy had been retained. The threat actors warned that unless the ransom was paid, the database and site files would be made publicly accessible on the Internet. They claimed to have saved a backup of the site, which they offered to restore upon payment, and they emphasized that no personal data was involved because the compromised information consisted solely of public records. No specific malware families, exploit kits, or initial access vectors were described in the reporting, limiting the observable TTPs to the defacement, encryption claim, and ransom note.

Public attribution beyond the alias and the presumed Russian location has not been established; no state sponsorship, criminal consortium affiliation, or broader campaign linkage has been identified in open sources. The Cluj County Council incident remains the sole publicly reported operation associated with Meowless, and it stands as an isolated example of a low‑value ransom demand directed at a regional government body. The council’s officials reported that they identified the vulnerability, initiated remediation, and restored the site from backups while confirming that no personal data had been exposed. This event represents the entirety of the verified information available about the threat actor Meowless.