Threat Intelligence Tarot
wands · 11
Russia (pro-Kremlin hacktivist affiliate)
★★★★★
risk 2/5
✦ The Affiliate ✦
UserSec
User Sec
EU government websitesNATO member statesWestern financial servicesMedia
Active since ~2023 · Pro-Russia DDoS operations, Anti-NATO disruption, Collective coordination
The Affiliate does not act alone - it coordinates, it republishes targets, it amplifies. UserSec is part of an ecosystem of pro-Russian hacktivist groups that operate in loose confederation, sharing infrastructure and timing attacks for maximum political theatre.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆DDoS coordination with NoName057(16) and other Russian hacktivist groups
- ◆European parliament and government website disruptions
- ◆Anti-Ukraine-support campaigns across EU member states
- ◆Coordinated attacks timed to political events
Defenses
- ▸DDoS protection with behavior-based traffic filteringNIST CSF: PR.DS ↗
- ▸Rate limiting on government and public-facing web servicesCIS Control 13 ↗
- ▸Incident communication plan for DDoS events to reduce amplificationNIST CSF: RS.CO ↗
Reversed: Their Weakness
UserSec and similar affiliates demonstrate the limits of DDoS as a strategic tool: their attacks generate media coverage far disproportionate to actual damage, and Western governments have learned to respond with muted public statements that deny the group the narrative win it seeks.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.