Cyber Incident Victim: Russian Federal Penitentiary Service
Date:
Mar 2022
Location:
Russia
Summary
Anonymous compromised the Russian Federal Penitentiary Service's official website, publishing anti-war imagery as part of broader operations against Russian entities. The hacktivist collective simultaneously hijacked over 400 surveillance cameras across various Russian facilities, overlaying feeds with messages condemning civilian casualties and accusing Russian leadership of concealing invasion atrocities. These actions complemented Anonymous' disruption of Russian TV channels to broadcast Ukraine war footage, targeting state propaganda mechanisms. The collective additionally defaced Belarusian websites amid these operations, while an affiliated group claimed a separate breach involving antivirus software source code. Activities focused on exposing wartime realities to Russian citizens through digital intrusions and message dissemination.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On or around March 8, 2022, the hacktivist collective Anonymous conducted cyber operations against Russian entities in response to the invasion of Ukraine. The group compromised the official website of the Russian Federal Penitentiary Service, defacing it with an anti-war image. This incident formed part of a coordinated campaign targeting Russian and Belarusian infrastructure, including government websites and digital platforms. Anonymous simultaneously hijacked over 400 Russian surveillance cameras across multiple categories—businesses, outdoor spaces, restaurants, offices, schools, and security offices—redirecting their live feeds to the website behindenemylines.live. The collective overlaid these feeds with text accusing Russian President Vladimir Putin of concealing atrocities, specifically citing "352 Ukraine civilians dead" and directing Russians to the URL 200RF.com.
The camera hijacking complemented Anonymous’ earlier disruption of Russian live TV channel streaming services, which the group replaced with war footage from Ukraine to counter state propaganda. These operations aimed to expose Russian civilians to realities of the conflict through compromised domestic systems. During the same period, Anonymous targeted Belarusian websites, though specific impacted entities beyond the Russian Federal Penitentiary Service remained unspecified in available reports. Concurrently, affiliate group Network Battalion 65 claimed responsibility for breaching Kaspersky and threatened to leak the antivirus vendor’s source code, though no corroborating evidence of this leak was provided in the immediate disclosure. The collective framed its actions as strategic counter-propaganda efforts leveraging compromised Russian digital assets to disseminate war-related information internally.