Cyber Guerilla
Attribution profile
- Type
- Activist
- Location
- Ukraine
- Known incidents
- 3 incidents
- Sources
- 1 source
- First seen
- 2014-02-20
- Last seen
- 2014-02-28
- Updated
- 2026-09-29 03:32
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
GURMO Cyber, also known as Cyber Guerilla, is a threat actor that has been identified as operating from Ukraine. The actor is primarily referenced in open‑source reporting as a hacktivist group that uses distributed denial‑of‑service tactics to disrupt online services. No further details about its organizational structure, size, or leadership are provided in the available sources.
The actor’s observed targeting focuses on Ukrainian governmental and political websites, including the parliament’s portal, nationalist movement sites such as Right Sector, and various Euromaidan support platforms. These targets were selected during periods of heightened political tension surrounding the Euromaidan protests, indicating a regional focus on Ukraine’s domestic political landscape. The strategic objective demonstrated in the reported incidents is disruption, as the actor employed DDoS attacks to temporarily render websites inaccessible, with no evidence of financial gain, data theft, or espionage activities described in the material.
The only technique explicitly associated with GURMO Cyber or Cyber Guerilla in the provided information is the use of distributed denial‑of‑service attacks to overwhelm target servers. No malware families, initial access vectors, or specific tooling styles are mentioned. Attribution to a state sponsor or criminal consortium is not established in the cited reports, and the actor is described solely as a hacktivist entity. A representative campaign occurred in late February 2014, when the actor claimed responsibility for DDoS attacks that disrupted the Ukrainian parliament’s website, the Right Sector domain, and several Euromaidan‑related sites amid the broader civil unrest. This operation illustrates the actor’s capacity to coordinate multiple simultaneous disruptions against politically significant online targets. No additional campaigns or operational details are available in the source material.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 1 source.