Cyber Threat Actor: Porteur

Porteur is a threat actor alias associated with hacktivist operations targeting Russian organizations during periods of heightened geopolitical conflict, particularly in early 2022. The alias has been publicly linked to collaborative efforts with other hacktivist entities, including Anonymous subgroups and NB65, within coordinated campaigns against entities perceived as supporting Russian state interests. Porteur’s activities align with broader hacktivist objectives of disrupting operations and exposing sensitive information through data theft and public leaks, often leveraging platforms like Distributed Denial of Secrets (DDoSecrets) to disseminate stolen material.

The actor’s targeting has focused on Russian critical infrastructure contractors and professional service providers with ties to state-affiliated entities. A prominent April 2022 operation compromised a Gazprom-linked gas pipeline construction firm, resulting in the exfiltration and leak of 222 GB of internal communications, decryption keys, and operational documents. This breach overlapped with attacks by multiple groups, suggesting opportunistic or loosely coordinated targeting of high-value Russian infrastructure. Earlier that year, Porteur participated in a February 2022 breach of a Russian law firm representing international corporations and state clients, collaborating with an individual using the alias B00da to leak 1 TB of emails and client data. These incidents reflect a consistent pattern of targeting organizations in energy, legal, and defense-adjacent sectors to inflict reputational damage and operational disruption. While Porteur’s specific tooling and initial access methods remain undocumented, their operations emphasize data aggregation and public dissemination, often aligning with broader hacktivist movements like Operation Russia. No explicit state affiliations or criminal consortium ties have been attributed to the actor in publicly available reporting.