Punishing Owl, a hitherto unidentified hacktivist group, has surfaced with sophisticated cyberattacks directed at Russian government security agencies This article explores breach punishing owl. . The group first surfaced on December 12, 2025, when it announced the successful breach of a Russian government security agency’s network.

Discover more Cyber Data security solutions Software for vulnerability scanning To increase public awareness of the compromise, the attackers duplicated the files on a Mega.nz repository and posted stolen internal documents on a data leak website. To increase the impact of their operation, the group used a variety of attack techniques. After gaining access to the victim’s DNS configuration, Punishing Owl created a subdomain and modified DNS records to redirect traffic to a server located in Brazil.

The stolen files and a political manifesto outlining their intentions were stored on this server. The attackers strategically chose Friday evening at 6:37 PM to announce the breach, timing calculated to delay response efforts and ensure maximum visibility of their activities. The group's social media post (Source: Habr) The group launched business email compromise attacks against the victim's contractors and partners after the initial breach.

Punishing Owl used addresses generated within the victim's email domain to send emails from a Brazilian server, according to Habr analysts. Learn more Threat intelligence feeds Software for detecting malware Software for data security These messages included urgent requests to review attached documents and falsely claimed to confirm the network compromise. Despite the group's recent rise to prominence, the attack infrastructure demonstrated technical sophistication.

DLS resource with victim files (Source – Habr) Punishing Owl configured fake TLS certificates, established IMAP and SMTP services for email operations, and deployed the ZipWhisper PowerShell stealer to harvest browser credentials from infected systems. The malicious emails downloaded the stealer from a command-and-control server at bloggoversikten[. ]com and included password-protected ZIP archives with hidden LNK files that ran PowerShell commands.

Credential Theft and Infection Mechanisms Sensitive browser data is extracted from compromised hosts by the multi-stage infection process used by the ZipWhisper stealer. When victims open the disguised LNK file, it silently executes PowerShell commands that download the stealer payload from the attacker’s infrastructure.

Learn more Services for cloud security Reports on security vulnerabilities Exploit The malware then collects files containing web browser credentials, cookies, and saved passwords, packaging them into ZIP archives with specific naming patterns that include the username and chunk numbers. manifesto of the group (Source: Habr) Before being uploaded to the command-and-control server via a specially designed endpoint structure, these archives are momentarily kept in the AppData/Local/Temp directory. Mimicry of the C2 domain (Source – Habr) The group may be using contemporary development techniques to expedite their operations against Russian critical infrastructure targets, according to comments found in the stealer's code that suggested the potential use of AI tools to generate parts of the malicious script.

Set CSN as a Preferred Source in Google to Receive More Instant Updates from LinkedIn and X.