Pro-Ukraine Hacking Cat Group Unleashes New Malware Against Russian Targets

• •Hacking Cat has evolved to deploy sophisticated malware against Russian targets.
• •New malware includes Gorilla RAT and Monkey Ransomware, with rapid development possibly aided by AI.
• •The group collaborates with other hacktivists, complicating attribution of attacks.

The pro-Ukraine hacktivist group Hacking Cat has developed new malware tools, including Gorilla RAT and Monkey Ransomware, targeting Russian organizations since February 2024. The group has transitioned from website defacements to more destructive attacks, with a focus on encrypting and destroying data. Kaspersky identified that the malware exploits vulnerabilities in Microsoft Exchange servers to gain access. The Monkey Ransomware, which encrypts files with a '.monkey' extension, has multiple variants developed since late summer 2025. The rapid evolution of these tools suggests possible use of generative AI in their development. Hacking Cat has collaborated with other hacktivist groups, including Cyber Anarchy Squad and Ukrainian Cyber Alliance, in various attacks. Notably, they claimed responsibility for breaching a contractor for Rosatom and executing a destructive attack on Donbassteploenergo. Kaspersky's report indicates that overlapping malware usage among different groups complicates attribution. Hacking Cat disputes Kaspersky's claims regarding some malware attributions.