AgainstTheWest

Profile narrative

The threat actor operates under the aliases AgainstTheWest and ATW and is publicly linked to the Anonymous collective. Open source reporting identifies the United States of America as the actor’s known location. The group emerged in early 2022 as part of the #OpRussia campaign launched after the invasion of Ukraine. Its stated purpose, as conveyed in public statements, was to disrupt Russian online presence and to provide information that could aid Ukrainian resistance. The actor’s activities were announced through Anonymous‑linked social media channels and were framed as a response to what the group described as an illegitimate invasion.

The actor’s targeting has focused on Russian governmental entities, state‑owned media outlets, and a broad range of private sector organizations including banks, hospitals, airports and energy companies. Specific incidents cited in reporting include breaches of the Russian Ministry of Economic Development website, the government portal gov.ru, and the state‑owned energy corporation Gazprom. In addition to government targets, the actor leaked internal chats and source code from the Conti ransomware group, indicating a focus on cybercrime groups that expressed support for Moscow. The disclosed material ranged from subdomain lists and back‑end server IPs to alleged invasion plans, strategic naval files and surveillance camera feeds from Ukrainian‑facing cameras. The breaches resulted in the publication of thousands of subdomains and backend IP addresses, which enabled further mapping of Russian infrastructure.

Observed tactics involve website defacement or unauthorized access, database exfiltration, and the public release of stolen documents and code. No specific malware families are mentioned in the source material; the actor’s tooling appears to rely on hacking web applications and compromising exposed devices such as IP cameras. Attribution remains tied to the Anonymous milieu, with the ATW subgroup and affiliated white‑hat hackers and researchers cited as participants, while no state sponsorship or criminal consortium has been publicly established. While the authenticity of some leaked military documents could not be independently verified, the actor nevertheless distributed them widely as part of its information campaign. The campaign exemplifies a coordinated effort to leak sensitive information and disrupt online services as a means of pressure on Russian institutions.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.