Kaspersky has published research on new tooling used by Hacking Cat, a pro-Ukraine hacktivist group that has been attacking Russian organisations since around February 2024 and, from roughly the summer of 2025, has shifted from website defacements and data leaks toward operations designed to encrypt and destroy data. Two malware families are attributed to the group: an undocumented custom remote-access tool dubbed Gorilla RAT, capable of tunnelling network traffic so attackers can reach systems inside a victim's network, and Monkey Ransomware, which encrypts user data and appends a .monkey extension. In some campaigns the group gained its initial foothold by exploiting vulnerabilities in Microsoft Exchange servers before deploying Gorilla RAT, and Kaspersky found numerous Monkey variants on compromised systems written in different programming languages, with an iteration pace the researchers describe as unusually rapid — possibly indicating generative AI assistance, or simply experimentation with the malware's capabilities. The more consequential finding is tool-sharing: different hacktivist groups have been observed using the same custom-built tools and, in some cases, identical multi-stage infection chains, such as the Nemo Wiper used in a joint operation with the Ukrainian Cyber Alliance, which appears built to destroy data and disrupt infrastructure rather than to generate ransom payments. That overlap suggests a common developer or small group maintaining malware distributed across several operations, and it makes attributing a specific attack to a specific actor significantly harder — a limit Hacking Cat itself exploited, rejecting Kaspersky's attribution of some of the malware as a false attribution while conceding that "a couple of the tools are ours". Prior operations carried by this group and its collaborators include a March claim of breaching a contractor to Russia's state nuclear corporation and a June destructive attack on a state-owned heating provider in Russian-occupied Donetsk.

• Source article