Cyber Threat Actor: Cyber Guerilla

GURMO Cyber, also known as Cyber Guerilla, is a hacktivist group that has been identified as operating from Ukraine. The actor emerged during the Euromaidan protests of early 2014 and has been described in open sources as conducting distributed denial‑of‑service attacks against Ukrainian online targets. Its activity is framed within the broader context of political unrest surrounding the country’s European Union association agreement and the ensuing demonstrations in Kiev. The group’s aliases appear in reporting that links it to the disruption of government, nationalist, and protest‑support websites.

The group's observed tactics consist primarily of volumetric DDoS campaigns aimed at rendering targeted services inaccessible. In the February 2014 incidents reported by Cyber Guerilla itself, the following domains were taken offline: maidansupport.com, maidanhelp.com.ua, helpmaidan.org.ua, banderivets.org.ua, rada.gov.ua and qha.com.ua. These targets included the Ukrainian parliament’s portal, the Right Sector nationalist movement’s site, and several Euromaidan‑aligned platforms such as maidansupport.com and maidanhelp.com.ua. The actor’s stated objective in these actions was to disrupt online services rather than to pursue financial gain or espionage, as the attacks were carried out without evidence of data exfiltration or ransom demands. The timing of the operations coincided with the escalation of street protests, indicating a focus on influencing the information environment during the crisis.

Attribution to a specific state sponsor or criminal consortium has not been established in the publicly available material; the group is presented as an independent hacktivist collective. Reporting notes that some participants in the broader hacktivist milieu appeared to align with opposition forces while others seemed to support the presidency, and that Anonymous Ukraine members leaked emails from the UDAR party and Vitali Klitschko’s private correspondence. These details illustrate the fluid affiliations within the hacktivist scene but do not define GURMO Cyber’s own allegiance. The February 2014 DDoS wave remains the most clearly documented operation associated with the actor, exemplifying its use of disruption‑oriented tactics amid a period of national turmoil.