Myrotvorets

Profile narrative

Myrotvorets is the alias used for a group identified in open sources as Ukrainian nationalist hackers. The group’s known location is Ukraine, though no precise headquarters or operational base is disclosed in the referenced material. It first came to public attention through a series of data leaks targeting journalists in 2016, and it has been described consistently across the available reports as acting from within Ukraine. The actor is not presented as a formal organization with a hierarchical structure, but rather as a loosely affiliated collective motivated by nationalist sentiment.

The group’s targeting focuses on the media sector, specifically journalists who have obtained press accreditation to work in conflict zones held by Russian‑backed forces in eastern Ukraine. The leaked data included personally identifiable information of both Ukrainian and foreign reporters representing over thirty international outlets such as CNN, Al Jazeera, Radio Free Europe, The Daily Beast, BBC and the Associated Press. Strategic objectives evident from the leaks appear to be twofold: to deter journalists from reporting from frontline areas by exposing them to financial risk and physical danger, and to disrupt the flow of independent reporting from the region. The sources note that the exposure of personal data normally poses financial hazards, but in the wartime context it also resulted in death threats via phone calls and social media, indicating an intent to intimidate and silence critical voices.

No specific malware families, initial access vectors or tooling styles are described in the provided sources, so no technical TTPs can be attributed to Myrotvorets based on the available evidence. Attribution to Ukrainian nationalist hackers is explicitly stated, while the material suggests that Ukrainian authorities responded with silence or tacit approval, though no formal state sponsorship or criminal consortium linkage is established. The most notable operation attributed to the group is the September 2016 release of journalist personal data, which marked the second such breach within four months and led to widespread threats against the affected reporters, illustrating the group’s capacity to conduct high‑impact data‑exposure campaigns aimed at influencing the information environment in the Ukrainian conflict.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.