Main Intelligence Directorate of Ukraine's Defense Ministry (HUR)
Attribution profile
- Type
- Nation State
- Location
- Ukraine
- Known incidents
- 8 incidents
- Sources
- 7 sources
- First seen
- 2023-11-28
- Last seen
- 2025-07-17
- Updated
- 2026-10-13 22:06
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The Main Intelligence Directorate of Ukraine's Defense Ministry (HUR), also referred to as HUR or Defense Intelligence of Ukraine, is a Ukrainian state‑linked threat actor. It primarily targets Russian entities across the energy, telecommunications, finance, government and military sectors, aiming to disrupt operations, destroy data and, in some cases, exfiltrate information such as tax‑service databases. Observed tactics include deploying malware to infect servers, conducting destructive wipes that erase databases, SCADA systems, BIOS and operating systems, launching DDoS attacks to overwhelm networks, disabling specific industrial control functions (e.g., drone identification and video‑streaming servers), destroying configuration files and backups, attacking cloud and file storage, and compromising third‑party IT contractors. The actor has claimed responsibility for high‑impact operations such as the wiping of Gazprom’s SCADA and 1C servers, the paralysis of Russia’s Federal Taxation Service through malware‑induced data destruction, widespread ATM and payment‑system failures across major Russian banks, the disruption of telecom services affecting platforms like Steam and Discord, and the degradation of Russian drone‑control programs that forced manual operation. Attribution to HUR is consistently cited in Ukrainian military‑intelligence statements and corroborated by open‑source reporting, establishing a clear state nexus to Ukraine’s Defense Ministry. No information on initial‑access vectors, tooling beyond the described malware and destructive tools, or financial motives is provided in the source material.
Incidents
Attributed incidents are available to members.
8 incidentsSources
Sources available to members: 7 sources.