Defence Intelligence of Ukraine

Summary

Ukraine's Defence Intelligence (HUR, also GUR) openly claims offensive cyber operations against Russia, usually announced through statements to Ukrainian media and signed with its owl emblem. Claimed operations include access to Russian Defence Ministry documents (Mar 2024), DDoS against the ruling United Russia party and, with BO Team, destruction at an MTS subsidiary (Apr 2024), theft of 4.4 GB from bomber-maker Tupolev and defacement of its site (Jun 2025), and, with the Cyber Corps group, disruption of the Wildberries marketplace timed with drone strikes (Aug 2026). The agency's role is self-declared; the scale and effect of each operation are its own claims and are rarely verifiable, so all campaigns are recorded as claimed.

Attribution

Operations claimed by HUR, often with hacktivist groups

The organisation publicly claims the operations itself; not independently verified.

• HUR statement, via Kyiv Independent (Own statement, 2024-03-04)
  HUR claims an attack on Russian Defence Ministry servers
• HUR statement, via The Record (Own statement, 2025-06-04)
  HUR claims the Tupolev intrusion
• HUR statement, via The Record (Own statement, 2026-08-17)
  HUR claims the Wildberries disruption

Campaigns 4

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Reporting and advisories 4

• HUR statement
  Russian Defence Ministry document access (HUR claim)
• HUR source
  United Russia DDoS and MTS-subsidiary destruction with BO Team (HUR claim)
• HUR statement
  Tupolev internal-systems breach and website defacement (HUR claim)
• HUR statement
  Wildberries disruption with Cyber Corps, timed with drone strikes (HUR claim)