A pro-Ukraine hacktivist group known as Hacking Cat has reportedly escalated its operations against Russian targets, moving from website defacements and data leaks to more destructive attacks involving data encryption and destruction. Cybersecurity researchers have identified new custom-built hacking tools associated with the group, which has been active since approximately February 2024.
According to a report from Russian cybersecurity firm Kaspersky, Hacking Cat began shifting towards operations designed to encrypt and destroy data by the summer of 2025. Kaspersky researchers discovered two malware families in attacks linked to the group: Gorilla RAT, a previously undocumented remote-access tool, and Monkey Ransomware.
Gorilla RAT is described as a custom tool capable of tunneling network traffic, which allows attackers to remotely access systems within a victim's network. In some instances, the attackers exploited vulnerabilities in Microsoft Exchange servers to establish an initial foothold before deploying Gorilla RAT.
Monkey Ransomware, which encrypts user data and appends the ".monkey" extension to affected files, first emerged in late summer or early fall of 2025. Kaspersky noted the rapid development of this malware, with numerous variants written in different programming languages appearing over subsequent months. This rapid evolution could suggest the use of generative AI in its creation or modification, or simply extensive experimentation by the attackers.
Hacking Cat often collaborates with other Ukraine-linked hacktivist groups. In March, Hacking Cat and Cyber Anarchy Squad claimed responsibility for breaching a contractor of Rosatom, Russia’s state nuclear energy corporation. In June, Hacking Cat partnered with the Ukrainian Cyber Alliance in a destructive attack against Donbassteploenergo, a state-owned heating provider operating in Russian-occupied parts of Ukraine’s Donetsk region. During this joint operation, the groups utilized malware identified as Nemo Wiper, which appears designed for data destruction and infrastructure disruption rather than ransom generation.
The use of shared custom-built tools and identical multi-stage infection chains across different hacktivist groups has been observed by researchers. This overlap complicates attribution and could indicate that a common developer or a small group of developers is creating and maintaining malware that is then distributed among multiple hacktivist operations.
However, Hacking Cat has disputed some of Kaspersky's attributions. In a Telegram statement, the group acknowledged that "a couple of the tools are ours," but explicitly denied responsibility for the "lockers," accusing Kaspersky of incorrectly linking tools from unrelated groups to Hacking Cat and criticizing the firm's reverse-engineering efforts.
