Cyber Incident Victim: Dozor
Date:
Mar 2022
Location:
Russia
Summary
A cyber operation attributed to a hacking collective targeted Russian infrastructure, compromising unsecured printers to disseminate anti-war messages and instructions for circumventing state censorship. The perpetrators printed over 100,000 copies of materials denouncing government propaganda and urging citizens to resist leadership, while also promoting tools for accessing uncensored information. Concurrently, the group claimed responsibility for disrupting official websites, though functionality was later restored. The incident aimed to undermine domestic support for military actions by exposing alleged state deception and facilitating access to independent media, with additional threats of releasing compromising data.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 20, 2022, a faction of the hacking collective Anonymous conducted a cyber operation targeting unsecured printers across Russia. The group announced via a Twitter account affiliated with Anonymous that they had printed over 100,000 copies of anti-propaganda materials and Tor browser installation instructions within two hours, with 15 operatives actively involved. Initial reports indicated access to 156 printers, though the final scope remained unspecified. The printed documents contained messages in Russian Cyrillic text asserting that President Vladimir Putin, the Kremlin, and state media had systematically deceived citizens about Russia's invasion of Ukraine. These materials characterized the war as driven by government fears of Western influence rather than legitimate security concerns, labeling Putin's actions as terrorism responsible for thousands of Ukrainian deaths. Citizens were urged to overthrow Putin's government, described as a corrupt system stealing from the populace, and to restore national honor by supporting peace for Ukraine.
The printer hack occurred within a broader series of cyber operations by Anonymous against Russian targets following the invasion of Ukraine. On March 13, 2022, the same Twitter account had previewed an impending "HUGE" data leak targeting Russia. Between March 19-20, Anonymous claimed responsibility for disrupting the Kremlin's official website (kremlin.ru), evidenced by server status screenshots showing the domain as offline. Russian authorities confirmed restoring functionality to the Kremlin website by March 24, though no public statements addressed the printer intrusions. The printed materials emphasized circumventing state censorship through Tor browser access while framing resistance as a moral imperative, stating that "a wad of paper and ink is a cheap price for the blood of the innocent." No verifiable reports detailed technical methodologies for printer access, containment measures by Russian entities, or quantitative assessments of operational disruption beyond the initial print volume claims.