Cyber Threat Actor: hdr0

hdr0 is a pro‑Ukrainian hacktivist group that uses the alias hdr0 and is known to operate from Ukraine. The group describes itself as a hacktivist collective focused on broadcasting political messages rather than pursuing financial gain or espionage. Its observed activity centers on the media sector, specifically targeting television and radio broadcasters in Russia and the annexed Crimea region. The stated strategic objective of these operations is to disseminate anti‑war narratives that compel Russian audiences to confront the realities of the conflict in Ukraine, as evidenced by the group’s own statements about forcing viewers to see the truth.

In September 2022 hdr0 claimed responsibility for hijacking several Russian television channels—including Channel One, Russia‑24 and Russia‑1—to air footage of Russian military actions in Ukraine, excerpts from speeches by President Volodymyr Zelensky and international leaders, and a message likening the invasion to the September 11 terrorist attacks. Earlier in May 2022 the group reportedly replaced the Victory Day parade broadcast in Moscow with an anti‑war statement accusing Russian leadership of responsibility for Ukrainian casualties. Additionally, hdr0 asserted that it had compromised a Russian TV station in Crimea to rebroadcast a Zelensky address and, in August 2022, aired a Zelensky speech followed by the declaration “Crimea is Ukrainian land.” These incidents illustrate a pattern of broadcast intrusion aimed at overriding state‑controlled programming with pro‑Ukrainian content.

The source material does not disclose any specific malware families, initial access vectors, or tooling techniques employed by hdr0; the group’s statements deliberately omitted technical details of how the breaches were achieved. Public attribution remains limited to the group’s self‑identification as a pro‑Ukrainian hacktivist collective, with no publicly presented evidence linking it to a state sponsor or criminal consortium. While pro‑Kremlin actors have conducted retaliatory cyber operations against Ukrainian media—such as spreading false health claims about Zelensky and inserting propaganda into streaming services—these actions are described separately and are not attributed to hdr0. The profile therefore reflects only the verifiable facts presented in the provided sources.