BO Team
Also known asBlack Owl · Lifting Zmiy · Hoody Hyena
Summary
Pro-Ukrainian group (also Black Owl, Lifting Zmiy, Hoody Hyena) that announced itself on Telegram in early 2024. Kaspersky has tracked it since then: early operations destroyed backups and virtual infrastructure and wiped hosts with SDelete, then advertised the damage; by 2026 it favoured covert espionage. Initial access is targeted phishing with documents and PDFs delivering its BrockenDoor backdoor (rewritten in C#) and ZeronetKit (with a UNIX build), alongside Remcos and DarkGate. In Q1 2026 it hit 20 organisations, shifting from healthcare to manufacturing, telecoms and oil and gas; a Feb 2026 incident showed possible operational overlap with Head Mare (tracked here as PhantomCore). Ukraine's HUR has claimed joint operations with it.
Attribution
Ukraine's HUR has claimed joint operations with it
Criminal or hacktivist group; no state sponsorship established.
- Kaspersky GReAT (Research, 2025-05-30)
Tracks BO Team (Black Owl) as a pro-Ukrainian hacktivist group
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| BrockenDoor / ZeronetKit phishing against manufacturing, telecoms and oil & gas (20 organisations) | 2026-01 – 2026-03 | Russia | Manufacturing, Telecommunications, Oil & Gas | Kaspersky GReAT (2026-05-06) |
| Destructive intrusions against Russian organisations — backup and virtual-infrastructure wiping | 2024 – 2025-05 | Russia | Healthcare, Manufacturing | Kaspersky GReAT (2025-05-30) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 4
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution1 | T1059.001PowerShell |
| Impact2 | T1485Data DestructionT1490Inhibit System Recovery |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| BrockenDoor | Backdoor (C#) | Windows |
| ZeronetKit | Backdoor (Windows and UNIX builds) | Windows |
| Remcos | Commodity RAT | Windows |
| DarkGate | Commodity loader/RAT | Windows |
Infrastructure patterns
- Spoofed sender domains styled after legitimate companies (Kaspersky, 2025)
- C2 domains such as tyranis[.]space and sorisu[.]net; ZeronetKit takes several C2 addresses (Kaspersky, 2026)
- Own Telegram channel announces its attacks (Kaspersky, 2025)