Site icon Check Point Blog

Hacktivists Call for Release of Telegram Founder with #FreeDurov DDoS Campaign

gmcdouga

In recent weeks, a new hacktivist campaign has emerged to demand the release of Telegram CEO Pavel Durov, after his arrest by French authorities. In this report, Check Point Research explores the most prominent and dominant hacking groups involved in the campaign.

Participating Groups

Cyber Army of Russia Reborn (CARR)

The CARR, Cyber Army of Russia Reborn AKA Russian Cyber Army Team, telegram channel was created in March 2022 shortly after the war between Russia and Ukraine began. The group primarily targets Ukraine and its allies with DDoS attacks. Previously, this group has performed significant attacks, such as compromising SCADA systems of water utilities in the United States, Poland, and France. Most recently, CARR was sanctioned by the US State Department for attacking US and Europe critical infrastructure. The group is affiliated to the Russia’s military intelligence service and the Russian GRU-related Sandworm group.

As of September 3, 2024, CARR’s main telegram channel has 62,181 members.

After announcing the operation #FreeDurov on August 24, AT 22:23 with a post on their channel, CARR began targeting French organizations with DDoS attacks.

The list of targets that were published on CARR’s channel is following:

Notably, the posts disclosing the attacks were removed from CARR’s channel after September 2nd.

The reason for the post removal is unclear given the group has a reputation of being “loud” and often boasts about their attacks, especially when mainstream media reports on their activity.

RipperSec

RipperSec is a pro-Islamic, likely Malaysian, hacktivist group that was created in June 2023. The Group’s previous targets included various organizations in Israel, governmental entities in the US, and Indian banking infrastructures. RipperSec claimed responsibility for attacking X (formerly Twitter) during the recent Donald Trump interview with Elon Musk. The group uses their own DDoS tool called MegaMedusa to launch attacks.

The group is believed to originate from Malaysia, although they claim that their founder has passed away and are now led by a Singaporean leader. As of September 3, 2024, their Telegram channel has 3,083 members.

On August 23rd, RipperSec published a post in their Telegram channel that they are shutting down their operations.

However, on the day of Durov’s arrest they revealed their intent to target France.

The list of targets that were published on the RipperSec channel:

 

EvilWeb

EvilWeb is a pro-Russian hacktivist group that was created in March 2024. As part of the support of the Russian narrative, the group targeted various American and European entities. EvilWeb operates in a hack-and-leak method, in parallel to leveraging traditional DDoS attacks. EvilWeb made claims to have allegedly obtained data from various high profile American organizations. As of September 3, 2024, the EvilWeb Telegram channel has 1,146 members.

EvilWeb announced their participation in #FreeDurov operation on August 25, 2024, and began executing DDoS and hacking attacks.

The following is the list of targets published by EvilWeb:

CyberDragon

CyberDragon is a pro-Russian hacktivist group created in September 2023. The group sporadically targets various Ukrainian organizations and NATO entities in support of Russia. Before engaging in #FreeDurov, CyberDragon carried out a campaign called #OP404 in coordination with other pro-Russian hacktivists groups to target Ukrainian hosting providers.

On August 26th, CyberDragon announced their participation in #FreeDurov. They posted in their Telegram channel stating that European governments want to control Telegram. The group also indicated that the attack was carried out together with the CARR group.

The list of targets that were published on the CyberDragon channel:

UserSec

UserSec is a pro-Russian hacktivist group that has been in operation since at least 2022. The current Telegram channel of the group contains 8,124 members as of September 3, 2024, and mostly targets NATO member states.

On August 25, 2024, the group published a post supporting the operation #FreeDurov and announced that they will target French entities in collaboration with CARR.

The list of targets that were published on UserSec channel:

STUCX Team

Stucx team is a Malaysian hacktivist group that has been operating since at least March 2023. Before October 7th, the group targeted Indian entities with DDoS attacks. After the Israel-Hamas war began on October 7th, the Stucx team began targeting Israeli organizations. Recently, the group targeted Argentina in a massive defacement and DDoS campaign.

On August 26th, the group published a post supporting #FreeDurov and began targeting France.

The list of targets that were published on Stucx team channel includes:

Conclusion

The arrest of Telegram founder Pavel Durov resonated with many hacktivists groups, mainly pro-Russian and pro- Islamic groups. The sentiment of the groups towards Durov varies. Many groups simply stated their support of Durov without engaging in any public activity, while other groups stated that their concern is the operational safety of Telegram, and that NATO wants to coerce Durov into compliance. A few Russian groups have proclaimed that Durov is “one of ours” and engaged in cyberwarfare due to patriotic reasons. In addition, Telegram is currently one of the main facilitators of the hacktivist’s activity, so those groups will be the first one to suffer from possible privacy setback in Telegram.

With Durov’s release  from police custody, it seems that the campaign #FreeDurov is in a dormant stage until the next action by the French authorities.

 

Exit mobile version