# Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian Targets via Exchange/SharePoint Exploitation

> Pro-Ukraine hacktivist collective Hacking Cat (Хакерский кiт), active since February 2024, escalated from defacements and leaks to destructive operations against Russian organizations by summer 2025, deploying a previously undocumented tunneling RAT (Gorilla RAT), multi-language ransomware (Monkey Ransomware, .monkey extension), and a data-destruction tool (Nemo Wiper). Kaspersky attributes initial access to exploitation of Microsoft Exchange (CVE-2021-26855, CVE-2026-42897) and SharePoint (CVE-2021-27076), and documents joint operations with Cyber Anarchy Squad (a March 2026 Rosatom contractor breach using ClearWater ransomware) and the Ukrainian Cyber Alliance (a June 2026 destructive Nemo Wiper attack on Donbassteploenergo, a Russian-occupied-Donetsk heating provider).

- **Published:** 2026-09-15T00:00:00Z
- **Last reviewed:** 2026-09-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2515
- **ID:** TL-2026-2515
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Hacking Cat (Ukraine)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-26855, CVE-2026-42897, CVE-2021-27076

## Description

Hacking Cat is a pro-Ukraine hacktivist group whose Telegram-based presence began in February 2024 with website defacements, data leaks, and the release of penetration-testing tooling targeting Russian organizations. Kaspersky's Securelist research (published alongside The Record's reporting on 2026-09-14) documents the group's pivot, starting around summer 2025, toward destructive operations: data encryption for extortion and outright data/infrastructure destruction, deployed against Russian organizations across multiple economic sectors.

Initial access in the documented intrusions traces to exploitation of internet-facing Microsoft Exchange Server (CVE-2021-26855, the ProxyLogon SSRF chain, and CVE-2026-42897, an OWA cross-site-scripting/spoofing zero-day patched by Microsoft on 2026-06-09 and separately exploited in the wild by the Russia-aligned group Laundry Bear/Void Blizzard against Western government targets) and Microsoft SharePoint Server (CVE-2021-27076, a replay-style InfoPath deserialization RCE). Post-exploitation, the group deploys Gorilla RAT, a previously undocumented Go-based reverse shell that communicates over WebSocket and provides TCP tunneling into the victim's internal network, plus command execution, file transfer, process management, and in some variants VNC access. Gorilla RAT performs anti-analysis checks (sleep-timing validation, minimum memory requirements, and process-name detection for wireshark, fiddler, procmon, x64dbg, x32dbg, ollydbg, ida, pestudio, and processhacker), persists via %LOCALAPPDATA% and a Windows Registry Run key, XOR-obfuscates its embedded C2 addresses, and beacons to its 'Lissa C2' panel roughly every 27-36 seconds (retrying every 12 seconds on failure) after registering victim telemetry (CPU core count, RAM, hostname, IP).

Monkey Ransomware, first observed in the wild in late summer/early fall 2025, was reimplemented by the group across at least four language/platform variants with minor functional differences: a Rust variant using ChaCha20-Poly1305 encryption (extensions .monkey/.xoxol/.benzona), a .NET variant using AES-256-CBC (extensions .monkey/.128bit/.x0x0l) that additionally extracts and exfiltrates stored Outlook credentials, a C++ variant (extensions .monkey/.obliviontea) that disables Task Manager, Command Prompt, Volume Shadow Copy Service, and SQL services and tampers with AMSI/ETW, and a Golang variant targeting Linux/ESXi (.monkeyRansomware extension). Common behavior across variants includes 32-byte key generation, privilege escalation attempts, termination of non-whitelisted processes, Volume Shadow Copy deletion (vssadmin), Windows Defender exclusion additions, Windows Event Log clearing, and PowerShell history deletion; several variants ship without functioning key-storage/recovery logic, meaning they behave as de facto wipers despite presenting a ransom demand. An independently analyzed Golang/Linux ELF sample (SHA256 257de0e2744c99a12cbc1c1b37c76e0e8a010dde3125ec09468a16e4f8e0f121) drops a ransom note at /root/Desktop/README.txt (contact monkeyransomware@onionmail.org, 24-hour deadline with doubling threat), persists via crontab @reboot, /etc/rc.local, and a systemd unit (/etc/systemd/system/monkey.service, Restart=always), attempts sudo re-execution for privilege escalation, disables SELinux/AppArmor/firewall services, collects a SHA-256(hostname||MAC) machine ID plus public IP/geolocation via api.ipify.org and ipapi.co, and reports victim telemetry to 179.43.139.126:5000/api/report/ — but exhibits non-functional encryption logic and Windows-specific command remnants embedded in the Linux binary, consistent with Kaspersky's assessment of AI-assisted, rapidly iterated development.

Nemo Wiper, used in the group's joint operation with the Ukrainian Cyber Alliance, is delivered via a PowerShell script (LSAPlatformUpdate.ps1) that registers a malicious DLL as a Windows network provider and forces a reboot into Safe Mode with Networking. On boot, the malicious network-provider DLL decrypts an embedded payload (nplsvc.exe, 167,436 bytes) using ChaCha20 and launches it as a service with a specific command-line token check; the payload displays a fake Windows Update screen while disabling keyboard and mouse input, then runs destructive wiper threads using a stolen user token. Destruction is size-proportional (overwriting up to 90% of files under 50MB down to roughly 10% of files over 100GB) followed by filling remaining free disk space with ~95MB random '.lock' files, and the tool disables USB mass storage via the HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR registry key to hinder physical remediation.

Attribution is complicated by extensive tool- and infrastructure-sharing among pro-Ukraine hacktivist clusters: in the March 2026 Rosatom-contractor breach, Hacking Cat and Cyber Anarchy Squad jointly deployed ClearWater ransomware via a Base64-encoded PowerShell batch script (1.bat) that contained a C2 IP typo (19.43.186.239 instead of 179.43.186.239); in the June 2026 Donbassteploenergo attack, Hacking Cat and the Ukrainian Cyber Alliance used an evolved version of the LSA network-provider delivery chain to drop Nemo Wiper instead of ransomware. Kaspersky correlated multiple C2 hosts (179.43.186.239, 179.43.186.246, 31.7.58.226) via shared SSH fingerprints on Private Layer-leased infrastructure; a co-located address (179.43.186.194) hosts the group's 'Cat Eyes OSINT' page, and historical Cobalt Strike C2 activity was observed on the same hosting cluster during 2025. Kaspersky also flags a possible connection to the 'Thor' cluster via shared exploitation of CVE-2021-27076 with exfiltration to 95.142.40.51. Hacking Cat responded on Telegram, acknowledging some tools ('a couple of the tools are ours') while denying involvement in the ransomware operations, underscoring the report's central finding that a common developer or small group likely builds and redistributes tooling across multiple nominally distinct hacktivist operations.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1543.003 Create or Modify System Process: Windows Service
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1053.003 Scheduled Task/Job: Cron
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1497 Virtualization/Sandbox Evasion
- T1518.001 Software Discovery: Security Software Discovery
- T1082 System Information Discovery
- T1555 Credentials from Password Stores
- T1570 Lateral Tool Transfer
- T1572 Protocol Tunneling
- T1071.001 Application Layer Protocol: Web Protocols
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1561.001 Disk Wipe: Disk Content Wipe
- T1529 System Shutdown/Reboot

## Sources

- [Pro-Ukraine Hacking Cat group deploying new malware against Russian targets](https://therecord.media/ukraine-malware-russia-ransomware)
- [Разбираем инструментарий группировки Hacking Cat (Хакерский кiт)](https://securelist.ru/tr/hacking-cat/117062/)
- [Monkey Ransomware — Some AI-written Ransomware](https://hexastrike.com/resources/blog/reverse-engineering/monkey-ransomware-some-ai-written-ransomware/)
- [CVE-2021-26855 - Microsoft Exchange Server Remote Code Execution Vulnerability (NVD)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-26855)
- [Unpatched Microsoft Exchange Server vulnerability exploited (CVE-2026-42897)](https://www.helpnetsecurity.com/2026/05/15/exchange-server-cve-2026-42897-exploited/)
- [On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email](https://thehackernews.com/2026/05/on-prem-microsoft-exchange-server-cve.html)
- [Addressing Exchange Server May 2026 vulnerability CVE-2026-42897](https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498)
- [Laundry Bear's new Microsoft Exchange attack triggers on email open (CVE-2026-42897)](https://www.helpnetsecurity.com/2026/07/30/cve-2026-42897-microsoft-exchange-email-attack/)
- [CVE-2021-27076: A Replay-Style Deserialization Attack Against SharePoint](https://www.thezdi.com/blog/2021/3/17/cve-2021-27076-a-replay-style-deserialization-attack-against-sharepoint)
- [CVE-2021-27076 - Security Update Guide - Microsoft](https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27076)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2515