National Republican Army

Profile narrative

The National Republican Army, also known by the abbreviation NRA, is a Russian-based hacking group that has publicly identified itself as working toward the overthrow of the Putin regime. The group’s location is noted as Russia, and its members have described their actions as a response to what they perceive as an unnecessary war with Ukraine. Their stated objective is to target organizations that support the government, framing their activity as a form of internal resistance rather than financial gain.

The NRA’s first publicly disclosed operation involved Unisoftware, a Russian software developer that provides services to government clients, from which the attackers claimed to have exfiltrated banking credentials, employee personal data, phone numbers, addresses, contracts and proprietary source code. The Kyiv Post verified the authenticity of the leaked material after reviewing files shared by the group, confirming that the data included information belonging to several Russian customers of Unisoftware. The attackers also claimed to have compromised additional clients of Unisoftware, although those assertions could not be independently verified in the reporting. In addition to the Unisoftware intrusion, the NRA has been linked to a breach of DNS, a major Russian IT retailer, where the attackers reportedly used external servers located outside the Russian Federation to gain access and exfiltrated an unspecified volume of personal information belonging to customers and employees while leaving payment card data intact.

The group has asserted that it maintained prolonged, undetected presence within Unisoftware’s networks for months before the disclosure, indicating a capability for sustained access without referencing specific malware families or exploit tools. No public reports associate the NRA with any state sponsorship, criminal syndicate or traditional financially motivated cybercrime, instead describing it as an ideologically driven hacktivist collective focused on political change within Russia. The NRA has publicly stated its intention to continue targeting entities that assist the Russian government in maintaining the current regime.

Incidents

Attributed incidents are available to members.