Legion
Attribution profile
- Type
- Activist
- Location
- Russia
- Known incidents
- 14 incidents
- Sources
- 1 source
- First seen
- 2016-12-09
- Last seen
- 2022-05-20
- Updated
- 2026-10-03 02:03
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Legion, also known as Legion, is a pro‑Russian hacker group that has conducted distributed denial‑of‑service attacks against Italian government ministries, airports, energy regulators, transport agencies and commercial firms, recruiting volunteers through Telegram channels and collaborating with the loosely organized Killnet collective to carry out propaganda‑driven disruptions aimed at undermining public confidence. The group also claimed responsibility for hijacking the Twitter accounts of Indian businessman Vijay Mallya and politician Rahul Gandhi, asserting that it exploited an undisclosed zero‑day vulnerability to leak personal and sensitive information as part of its stated goal of exposing a corrupt system. While Legion coordinates via Telegram and shares tactics with Killnet, public reporting has not established a direct nexus to any state actor.
Incidents
Attributed incidents are available to members.
14 incidentsSources
Sources available to members: 1 source.