26 February 2024

The new Net Worker Alliance group attacks and defaces various NATO and European entities

According to a report dated July 31, 2023, a new group of pro-Russian hacktivists called the "Net Worker Alliance" has announced its formation ahead of several offensive cyber actions against European entities and NATO members. The other sub-groups in the alliance are: BloodNet, Phoenix, Kvazar, BlueNet, Contagio, Chaossec. The group behind this alliance appears to be the hacktivist group "Usersec," which has been very active for several months. Their stated objective is to "secure the cyberspace of the Russian Federation."

Shortly after the group was formed, it directly claimed to possess confidential documents belonging to NATO before posting a sample on their communication channel in .rar format. The veracity of this claim, as well as that of the documents, has not yet been verified.

Lastly, the group's latest attack is a major campaign to deface 40 websites of Czech entities, particularly small and medium-sized businesses. The attack is believed to have been carried out by the Bloodnet sub-group. Additionally, several Polish entities have fallen victim to Distributed Denial of Service (DDoS) attacks, resulting in their websites being unavailable for an unknown period. The affected entities are: landtech, alfanet24, and sekocin. During its DDoS attacks, the group also claimed to have targeted the Europol website in the afternoon of July 31.

The formation of this alliance of cyber hacktivists comes at a time when the group "KillNet" appears to be losing momentum in its politicized and high-profile activities. Some of Networker's sub-groups are also members of KillNet's sub-groups. It is possible that KillNet has gradually slowed down its purely hacktivist activities since announcing its professionalization in several areas. After claiming to have become a group of cyber mercenaries, communications and the organization of attacks have become rarer without disappearing, leaving the media space to groups like Usersec. The latter, probably in an attempt to regain media continuity, has created its own alliance, which could continue to grow and carry out the attack campaigns previously conducted by KillNet against countries critical of Russia, thus becoming part of the ongoing destabilization campaigns that have employed DDoS and defacement tactics since the beginning of the war in Ukraine. It is foreseeable that, if this new group continues its activities, it will continue to claim responsibility for numerous attacks in Europe.