Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian Targets via Exchange/SharePoint Exploitation

Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey (TL-2026-2515), also tracked as Хакерский кiт, is a high-severity ransomware operation, first published 2026-09-15. It is attributed to Hacking Cat (Ukraine) with medium confidence, affects Microsoft Exchange Server, references 3 CVEs (CVE-2021-26855, CVE-2026-42897, CVE-2021-27076), maps to 20 MITRE ATT&CK techniques (T1053.003, T1053.005, T1059.001), and is covered by 9 detection rules and 29 indicators of compromise.

Key facts for TL-2026-2515

Threat ID
TL-2026-2515
Also known as
Хакерский кiт, Khakerskiy Kit
Severity
HIGH
Status
ACTIVE
Category
RANSOMWARE
First published
2026-09-15
Last reviewed
2026-09-15
Attribution
Hacking Cat
Attribution confidence
MEDIUM
Nation-state nexus
Ukraine
Motivation
HACKTIVISM
Target sectors
energy, critical infrastructure, utilities, government contractors, nuclear energy
Target regions
russia, Russian-occupied Donetsk region
Detection rules
9
Indicators of compromise
29

Malware and tooling in Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey

Malware and tooling: Gorilla RAT, Monkey Ransomware, Nemo Wiper, clearwater, Lissa C2

Pro-Ukraine hacktivist collective Hacking Cat (Хакерский кiт), active since February 2024, escalated from defacements and leaks to destructive operations against Russian organizations by summer 2025, deploying a previously undocumented tunneling RAT (Gorilla RAT), multi-language ransomware (Monkey Ransomware, .monkey extension), and a data-destruction tool (Nemo Wiper). Kaspersky attributes initial access to exploitation of Microsoft Exchange (CVE-2021-26855, CVE-2026-42897) and SharePoint (CVE-2021-27076), and documents joint operations with Cyber Anarchy Squad (a March 2026 Rosatom contractor breach using ClearWater ransomware) and the Ukrainian Cyber Alliance (a June 2026 destructive Nemo Wiper attack on Donbassteploenergo, a Russian-occupied-Donetsk heating provider).

How Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey works

Hacking Cat is a pro-Ukraine hacktivist group whose Telegram-based presence began in February 2024 with website defacements, data leaks, and the release of penetration-testing tooling targeting Russian organizations. Kaspersky's Securelist research (published alongside The Record's reporting on 2026-09-14) documents the group's pivot, starting around summer 2025, toward destructive operations: data encryption for extortion and outright data/infrastructure destruction, deployed against Russian organizations across multiple economic sectors.

Initial access in the documented intrusions traces to exploitation of internet-facing Microsoft Exchange Server (CVE-2021-26855, the ProxyLogon SSRF chain, and CVE-2026-42897, an OWA cross-site-scripting/spoofing zero-day patched by Microsoft on 2026-06-09 and separately exploited in the wild by the Russia-aligned group Laundry Bear/Void Blizzard against Western government targets) and Microsoft SharePoint Server (CVE-2021-27076, a replay-style InfoPath deserialization RCE). Post-exploitation, the group deploys Gorilla RAT, a previously undocumented Go-based reverse shell that communicates over WebSocket and provides TCP tunneling into the victim's internal network, plus command execution, file transfer, process management, and in some variants VNC access. Gorilla RAT performs anti-analysis checks (sleep-timing validation, minimum memory requirements, and process-name detection for wireshark, fiddler, procmon, x64dbg, x32dbg, ollydbg, ida, pestudio, and processhacker), persists via %LOCALAPPDATA% and a Windows Registry Run key, XOR-obfuscates its embedded C2 addresses, and beacons to its 'Lissa C2' panel roughly every 27-36 seconds (retrying every 12 seconds on failure) after registering victim telemetry (CPU core count, RAM, hostname, IP).

Monkey Ransomware, first observed in the wild in late summer/early fall 2025, was reimplemented by the group across at least four language/platform variants with minor functional differences: a Rust variant using ChaCha20-Poly1305 encryption (extensions .monkey/.xoxol/.benzona), a .NET variant using AES-256-CBC (extensions .monkey/.128bit/.x0x0l) that additionally extracts and exfiltrates stored Outlook credentials, a C++ variant (extensions .monkey/.obliviontea) that disables Task Manager, Command Prompt, Volume Shadow Copy Service, and SQL services and tampers with AMSI/ETW, and a Golang variant targeting Linux/ESXi (.monkeyRansomware extension). Common behavior across variants includes 32-byte key generation, privilege escalation attempts, termination of non-whitelisted processes, Volume Shadow Copy deletion (vssadmin), Windows Defender exclusion additions, Windows Event Log clearing, and PowerShell history deletion; several variants ship without functioning key-storage/recovery logic, meaning they behave as de facto wipers despite presenting a ransom demand. An independently analyzed Golang/Linux ELF sample (SHA256 257de0e2744c99a12cbc1c1b37c76e0e8a010dde3125ec09468a16e4f8e0f121) drops a ransom note at /root/Desktop/README.txt (contact monkeyransomware@onionmail.org, 24-hour deadline with doubling threat), persists via crontab @reboot, /etc/rc.local, and a systemd unit (/etc/systemd/system/monkey.service, Restart=always), attempts sudo re-execution for privilege escalation, disables SELinux/AppArmor/firewall services, collects a SHA-256(hostname||MAC) machine ID plus public IP/geolocation via api.ipify.org and ipapi.co, and reports victim telemetry to 179.43.139.126:5000/api/report/ — but exhibits non-functional encryption logic and Windows-specific command remnants embedded in the Linux binary, consistent with Kaspersky's assessment of AI-assisted, rapidly iterated development.

Nemo Wiper, used in the group's joint operation with the Ukrainian Cyber Alliance, is delivered via a PowerShell script (LSAPlatformUpdate.ps1) that registers a malicious DLL as a Windows network provider and forces a reboot into Safe Mode with Networking. On boot, the malicious network-provider DLL decrypts an embedded payload (nplsvc.exe, 167,436 bytes) using ChaCha20 and launches it as a service with a specific command-line token check; the payload displays a fake Windows Update screen while disabling keyboard and mouse input, then runs destructive wiper threads using a stolen user token. Destruction is size-proportional (overwriting up to 90% of files under 50MB down to roughly 10% of files over 100GB) followed by filling remaining free disk space with ~95MB random '.lock' files, and the tool disables USB mass storage via the HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR registry key to hinder physical remediation.

Attribution is complicated by extensive tool- and infrastructure-sharing among pro-Ukraine hacktivist clusters: in the March 2026 Rosatom-contractor breach, Hacking Cat and Cyber Anarchy Squad jointly deployed ClearWater ransomware via a Base64-encoded PowerShell batch script (1.bat) that contained a C2 IP typo (19.43.186.239 instead of 179.43.186.239); in the June 2026 Donbassteploenergo attack, Hacking Cat and the Ukrainian Cyber Alliance used an evolved version of the LSA network-provider delivery chain to drop Nemo Wiper instead of ransomware. Kaspersky correlated multiple C2 hosts (179.43.186.239, 179.43.186.246, 31.7.58.226) via shared SSH fingerprints on Private Layer-leased infrastructure; a co-located address (179.43.186.194) hosts the group's 'Cat Eyes OSINT' page, and historical Cobalt Strike C2 activity was observed on the same hosting cluster during 2025. Kaspersky also flags a possible connection to the 'Thor' cluster via shared exploitation of CVE-2021-27076 with exfiltration to 95.142.40.51. Hacking Cat responded on Telegram, acknowledging some tools ('a couple of the tools are ours') while denying involvement in the ransomware operations, underscoring the report's central finding that a common developer or small group likely builds and redistributes tooling across multiple nominally distinct hacktivist operations.

MITRE ATT&CK techniques used in TL-2026-2515

Persistence

T1053.003 Scheduled Task/Job: Cron; T1053.005 Scheduled Task/Job: Scheduled Task; T1543.003 Create or Modify System Process: Windows Service; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.001 Command and Scripting Interpreter: PowerShell

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1572 Protocol Tunneling

Discovery

T1082 System Information Discovery; T1518.001 Software Discovery: Security Software Discovery

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot; T1561.001 Disk Wipe: Disk Content Wipe

Defense Evasion

T1497 Virtualization/Sandbox Evasion

Privilege Escalation

T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Credential Access

T1555 Credentials from Password Stores

Lateral Movement

T1570 Lateral Tool Transfer

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Affected products and versions in Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey

  • Microsoft — Exchange Server
    Vulnerable versions: Exchange Server 2013 CU21-23; Exchange Server 2016 CU8-19; Exchange Server 2019 (base and CU1-8); Exchange Server 2016/2019/Subscription Edition (pre 2026-06-09 patch, OWA)
    Fixed in: Post-2021 cumulative updates addressing CVE-2021-26855; 2026-06-09 security update addressing CVE-2026-42897
  • Microsoft — SharePoint Server
    Vulnerable versions: SharePoint Server 2019 pre-March 2021
    Fixed in: SharePoint Server 2019 with KB4493230 and later

Remediation for Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey

Patches

  • Microsoft Exchange Server cumulative update addressing CVE-2021-26855
  • Microsoft Exchange Server security update for CVE-2026-42897 (released 2026-06-09)
  • Microsoft SharePoint Server 2019 security update KB4493230 (CVE-2021-27076)

Immediate actions

  • Patch/verify Microsoft Exchange Server against CVE-2021-26855 (ProxyLogon SSRF) and CVE-2026-42897 (OWA XSS/spoofing, fixed 2026-06-09)
  • Patch Microsoft SharePoint Server against CVE-2021-27076 (InfoPath deserialization RCE, KB4493230 and later)
  • Hunt for scheduled tasks created as SYSTEM via schtasks and for unexpected Windows network-provider DLL registrations
  • Block/monitor the identified C2 IP ranges (179.43.186.0/24, 31.7.58.226, 179.43.139.126) and the domain khinkal.net at the network perimeter
  • Audit Windows Defender exclusion lists and AMSI/ETW state for unauthorized modifications
  • Restrict or alert on unattended reboots into Safe Mode with Networking on servers

Workarounds

  • Disable OWA external access or enforce strict CSP/sanitization pending patch validation for CVE-2026-42897
  • Restrict SharePoint InfoPath forms services where not required
  • Place Exchange/SharePoint servers behind a reverse proxy/WAF with virtual patching for known exploit patterns

Longer-term hardening

  • Deploy EDR/NDR with behavioral detection for WebSocket-based reverse-shell C2 and ransomware/wiper file-activity patterns (mass rename, VSS deletion, free-space fill)
  • Enforce offline/immutable backups and test recovery against a wiper scenario (not just ransomware) given multiple variants lack functional decryption
  • Harden credential storage (disable/limit Outlook password caching, deploy credential-guard) given documented Outlook credential theft
  • Network-segment Exchange/SharePoint servers from the broader environment to limit lateral tool transfer after initial compromise
  • Restrict/monitor USB storage policy enforcement (HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR) tampering as a wiper post-destruction indicator

CVEs associated with Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey

CVE-2021-26855, CVE-2026-42897, CVE-2021-27076

Weaknesses (CWE) in Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey

CWE-918, CWE-79, CWE-502

Timeline of Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey

  • Hacking Cat's Telegram-based presence launches, beginning with website defacements, data leaks, and pentest-tool releases targeting Russian organizations.
  • Kaspersky observes historical Cobalt Strike C2 activity during 2025 on the same Private Layer-hosted IP cluster (179.43.186.214, 179.43.186.223) later reused for Hacking Cat's Gorilla RAT and ClearWater infrastructure.
  • By summer 2025 Hacking Cat shifts its operational focus from defacement/leaks toward data-encryption and data-destruction campaigns against Russian organizations.
  • Monkey Ransomware first appears in the wild in late summer/early fall 2025, subsequently reimplemented by the group in Rust, .NET, C++, and Golang variants.
  • Hexastrike Cybersecurity publishes independent reverse-engineering analysis of a Golang/Linux ELF Monkey Ransomware sample (SHA256 257de0e2744c99a12cbc1c1b37c76e0e8a010dde3125ec09468a16e4f8e0f121), noting AI-assisted, non-functional encryption logic.
  • Hacking Cat and Cyber Anarchy Squad jointly breach a contractor working for Rosatom, Russia's state nuclear energy corporation, deploying ClearWater ransomware via a Base64-encoded PowerShell batch script.
  • Microsoft discloses CVE-2026-42897, an Exchange Server OWA cross-site-scripting/spoofing vulnerability under active exploitation in the wild, subsequently cited by Kaspersky as one of Hacking Cat's Exchange initial-access vectors.
  • Hacking Cat and the Ukrainian Cyber Alliance conduct a destructive attack on Donbassteploenergo, a state-owned heating provider in Russian-occupied Donetsk, deploying Nemo Wiper via an evolved LSA network-provider delivery chain.
  • Microsoft releases the security update addressing CVE-2026-42897 for on-premises Exchange Server.
  • Kaspersky publishes Securelist research on Hacking Cat's toolkit (Gorilla RAT, Monkey Ransomware, Nemo Wiper); The Record reports on the findings the same day, and Hacking Cat responds on Telegram partially acknowledging but disputing aspects of the attribution.

Sources cited for Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey

More in ransomware

Detection coverage for TL-2026-2515

As of 2026-09-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2515 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2515

5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats