Introduction
Over the past three years, hacktivist activity in Russian-speaking communities has increased significantly. With ongoing armed conflicts, especially the Russia–Ukraine war, the battlefield has expanded beyond the physical world, with many fights now happening online. These operations have become more visible, better planned, and more advanced, often causing significant damage.
On July 28, 2025, Aeroflot, Russia’s state-owned national carrier, was hit by a major cyberattack, disrupting computer systems at its hubs. The pro-Ukrainian collective Silent Crow, active since approximately December 2024, coordinated with the Belarusian Cyber Partisans, which emerged around September 2020, claimed responsibility for the attack.
The collaboration between these two groups illustrates how cyber resistance is evolving beyond national borders, especially when political goals align. It also shows that hacktivism has moved beyond symbolic gestures, becoming operational, strategic, and deliberately public. Alongside the physical damage, clear examples of psychological warfare tactics were observed, which we examine in detail in this report.
Silent Crow and Belarusian Cyber Partisans: Profiles and Past Attacks
Both Silent Crow and the Belarusian Cyber Partisans present themselves as hacktivist groups and resistance movements. Yet, they stem from different national and political contexts: Silent Crow from Ukraine, and the Cyber Partisans from Belarus. What unites them is clear: shared hostility toward the Russian state, and a strategic use of cyber operations to undermine its infrastructure and perception of control.
The Belarusian Cyber Partisans appeared first, around September 2020, following mass protests in Belarus after the country’s contested presidential election. What began as a domestic movement against Alexander Lukashenko’s regime quickly evolved into a broader pro-democracy and anti-authoritarian agenda. Their operations focused on targeting Belarusian government systems but soon expanded to include Russian-linked entities, especially those supporting surveillance, repression, or military aggression.
Over the years, the Belarusian Cyber Partisans have established multiple communication channels, including Telegram, Twitter, and even their own website. Like many hacktivist groups, they ask for donations through cryptocurrency addresses, including XMR, BTC, ETH, USDT (ETH), and USDC (ETH). Based on a review of one BTC address, it received nearly USD 206,000 between December 12, 2022, and July 27, 2025. The donation amounts vary, with the largest incoming transaction close to $20,000 and the smallest around $10.
Silent Crow, by contrast, emerged more recently around December 2024 and directly out of the ongoing Russia–Ukraine war. The group presents itself as part of Ukraine’s digital resistance and conducts targeted, high-impact operations against Russian state services and strategic infrastructure.
On its Telegram channel @crowsilent (currently defunct) registered on December 25, 2024, the group claimed its first victim as Federal Service for State Registration, Cadastre, and Cartography of the Russian Federation (Abbreviation – Rosreestr – Rus: Федеральная служба государственной регистрации, кадастра и картографии).
“Today is our first post, and although a bit late, we would like to wish Russians a Happy New Year. Not long ago, we hacked and extracted the databases of Rosreestr, which contained personal information on every citizen of the Russian Federation,” the group stated in their first message. According to the statement, “approximately 90,000,000 rows from the Unified State Register of Real Estate Objects” were leaked, while “the full data dump contains around 2,000,000,000 rows.
After the Rosreestr breach, Silent Crow claimed responsibility for several other attacks, including Russian telecom giant Rostelecom. The latter reportedly resulted in the theft of 154,000 email addresses and 101,000 phone numbers of Russian users. While Rostelecom confirmed the data breach, it did not confirm the identity of the attackers.
While different in origin, the two groups collaborated in the July 2025 Aeroflot cyberattack, marking a new level of coordination. According to their statement, they wiped out databases and information systems, stealing or destroying sensitive data, including flight history, surveillance recordings, and executive audio logs, reportedly compromising around 7,000 servers.
Given the scale of disruption and the depth of system compromise, this appears to be the most significant cyberattack ever launched against a Russian entity by hacktivist groups. As a result of the attack, Aeroflot was forced to cancel or delay 42% of its flights. At the direction of the Russian Prosecutor General’s Office, a criminal case has been initiated based on the findings of a prosecutorial investigation, under Part 4 of Article 272 of the Criminal Code of the Russian Federation (unauthorized access to computer information).
Source: Telegram
Beyond the immediate financial damage, the psychological toll is considerable, undermining public confidence in the resilience of Russia’s critical infrastructure. In this case, the attackers went beyond system disruption and incorporated a range of psychological tactics designed to intimidate, humiliate, and destabilize.
We observed multiple psychological techniques intentionally embedded into the attack strategy, from cultural references and coded language to carefully crafted messaging, all aimed at amplifying fear, confusion, and loss of control. In the following section, we take a closer look at these methods and how they were deployed.
The Aeroflot Cyberattack: Where Hacktivism Meets Psychological Warfare
The Aeroflot hack carried out by Silent Crow in collaboration with the Belarusian Cyber Partisans is a clear demonstration of how personal and strategic the cyber front has become in the Russia–Ukraine conflict. It wasn’t just an attempt to bring down servers; it was a deliberate, multilayered act of psychological warfare designed to strike not only infrastructure but also confidence and perception.
First and foremost, this attack, like many high-impact cyber incidents, resulted in widespread coverage across both social media and news platforms. In addition to official reporting, there was a wave of reports from customers directly affected, as well as commentary from bystanders. All of this undoubtedly damaged Aeroflot’s public image.
Another important angle is the psychological and reputational harm linked to existing public sentiment in Russia, particularly the widespread perception of state corruption. Since Aeroflot is a state-owned company, many online comments questioned how public funds were being used, with posts asking how billions could be invested while systems were so easily compromised.
Below is a screenshot of an Instagram reel, pulled from a search of the keyword “Аэрофлот” (Aeroflot) two days after the attack. It also includes a snippet from a digital media article by Successes of Russia (Rus: Успехи России) criticizing the airline’s inability to protect customer data. The article highlights possible systemic corruption at both the company and state level, using the ironic headline: “The cyberattack on Aeroflot shows where 28 billion was spent, yet the system still collapsed” (Rus: Кибератака на «Аэрофлот» показала, на что потратили 28 миллиардов, в итоге система рухнула)
Source: Instagram & Successes of Russia
When it comes to the nature of the messages disseminated by groups directly alongside the attack, it shows how deeply these actors understand their target. The cultural proximity between post-Soviet societies, including Ukraine, Belarus, and Russia, shaped by decades of shared history under the Soviet Union, plays a key role in their effectiveness. Ukrainian and Belarusian hacktivists share the same language (with most people being bilingual in both their native language and Russian), as well as common social references, historical context, and institutional familiarity with the very systems they aim to disrupt.
That shared cultural code allows these groups to leverage deep psychological insight into what narratives will resonate, use symbolism and memes that feel native to Russian audiences, and exploit institutional weak points with precision, not just technically, but emotionally. So, what techniques did the actors use exactly?
The attack against Aeroflot is politically motivated, according to a statement published by the Belarusian Cyber Partisans on their website: “We will continue our attacks on the aggressors as long as the Russian regime poses a direct threat to the territorial integrity and independence of Belarus and Ukraine. Every enterprise or organization operating on the territory of Russia and Belarus that serves the Kremlin dictatorship may share Aeroflot’s fate.”
Along with their statement, they attached an image of two confused pilots in front of an airplane with the Aeroflot logo in the background. To someone unfamiliar with Russian culture, it might appear to be just a random humorous image. However, for many Russians, the reference is instantly recognizable.
The image is a still from a clip of the well-known Russian TV comedy show Village of Fools (Russian: Деревня дураков), a popular series that aired from 1996 to 2001 and remains a recognizable part of post-Soviet pop culture. The show was extremely popular during its time and remains part of Russia’s cultural memory, often resurfacing in the form of memes. The particular skit used in the post features two panicked pilots inside a crashing plane, referencing the show’s famous “Sharp Nosedive” (Rus: Крутое Пике). You can watch one of the segments here.
Source: Belarusian Cyber Partisans website
In addition to the websites where the message was disseminated, these groups leverage Telegram for both operational coordination and psychological influence. This includes a message from Silent Crow, with a screenshot shared earlier in the report, where the actors describe the damage they inflicted.
The message was further disseminated through so-called amplifier channels. For years, hacktivist groups on both sides, pro-Russian and pro-Ukrainian, have used Telegram not just to claim responsibility, but to spin, amplify, and meme their messages into psychological weapons. These groups run their channels, but they are also supported by entire ecosystems of “news,” fan, and support accounts that boost visibility, coordinate messaging, and maximize overall impact.
One such channel disseminating messages about the Aeroflot attack was the Telegram channel @HackYourMom, which currently has nearly 40,000 followers. On July 28, 2025, the day the Aeroflot attack took place, the channel published a series of posts that serve as a case study in psychological operations. Let’s break down one of those posts and the tactics that were used:
1. Language Targeting
Although the HackYourMom channel primarily publishes content in Ukrainian, the specific post related to the Aeroflot cyberattack was written in Russian, a calculated and deliberate decision aimed at maximizing psychological reach.
By using Russian, the message becomes immediately accessible and relatable to a broader domestic audience in Russia, including Aeroflot employees and customers, directly affected by the attack, agency officials such as FSB and GRU personnel, indirectly targeted through ridicule and blame, and the general Russian public, many of whom rely on Aeroflot for travel and see it as a symbol of national prestige.
This linguistic shift is not accidental; it’s a tactic. It enables the attackers to speak directly to their adversary using their language, making the content feel personal, invasive, and harder to dismiss, reinforcing the message: “We know you, we understand you, and we can reach you.”
2. Cultural Weaponization via Comedy
The attached video includes a clip from the classic TV comedy Village of Fools. As previously explained in the report, the same imagery was also used on the Belarusian Cyber Partisans’ website, reinforcing the cross-channel coordination and messaging consistency. Referencing the show’s iconic “sharp nosedive” segment, this clip is cleverly paired with the line: “Aeroflot shares took a sharp nosedive, already down more than 3%.”
Comedy here is not just a tool for engagement, it’s a weapon of soft influence. The attackers are mocking not just Aeroflot’s failure, but the state’s inability to protect one of its flagship institutions. By weaponizing cultural nostalgia, the attackers transform a cyberattack into a shared cultural moment of national embarrassment. It’s a form of psychological warfare that has an impact because it feels painfully domestic.
3. Code-Speak and Mockery
Another tactic is the use of jargon and coded language, such as the term “узкие” (“narrow-minded ones”) in place of “русские” (“Russians”), a form of phonetic play. In the Aeroflot attack messaging, the term is used in two ways: first, to mock the general Russian public, and second, to directly insult Russian cybersecurity firms, referring to them as “узким ИБ шарагам.”
The full phrase, “узким ИБ шарагам,” essentially translates to something like “Russia’s incompetent infosec crews” or “clueless state cybersecurity goons.” It combines technical insult with cultural mockery, a classic example of how language is weaponized for psychological effect.
Here’s a breakdown of the phrase:
- “узким” – a mocking phonetic twist on “русским” (Russians); literally means “narrow,” used as a coded, derogatory stand-in for Russians
- “ИБ” – abbreviation for “информационная безопасность” → information security (InfoSec)
- “шарагам” – a slangy, mocking form of “шараги”, a dismissive term for shady or low-grade organizations, often implying incompetence or poor quality of service
With this deliberate choice of words, the language goes beyond simple mockery; it becomes a tool for digitally and culturally undermining Russian identity, especially targeting infosec professionals and state-linked IT entities.
Source: HackYourMom Telegram channel
What Can We Learn from the Aeroflot Attack?
What we’re seeing is the evolution of hacktivism into a broader form of influence warfare, where technical disruption is paired with psychological tactics to maximize impact. The Aeroflot cyberattack illustrates how today’s hacktivist groups operate: strategically, internationally, and with a strong awareness of how to manipulate perception and public sentiment.
First, the operation demonstrated the rise of cross-border collaboration between non-state actors such as Ukraine and Belarus. United by shared political aims, these groups coordinated effectively to launch a campaign that blended technical skill with psychological precision.
Second, the attack showcased a diverse toolkit of tactics that went far beyond technical damage. These methods targeted Aeroflot’s reputation and public trust. By leveraging deep cultural familiarity, the attackers were able to craft messages, memes, and symbolic references that resonated strongly with Russian audiences.
This content, circulated primarily through Telegram and other social media platforms, was amplified by the Media and reached far beyond the airline itself, striking at the broader public perception and national identity tied to Aeroflot. Amid ongoing geopolitical conflict, this attack sets an important precedent: non-state actors with cultural fluency and digital agility are now capable of challenging state authority not just through disruption, but through narrative control and psychological pressure.
Finally, the Aeroflot case exposes just how vulnerable state-linked infrastructure has become, not only to cyberattacks, but to the ease with which those attacks can be carried out. What should be a highly protected national asset was breached and dismantled with striking efficiency, revealing gaps in cybersecurity readiness, outdated systems, and weak organizational defenses.
Hacktivist groups and the threats they pose continue to grow, making it critically important to understand how they operate and what motivates them. Gaining insight into their tactics and techniques is essential not only for defending the digital perimeter but also for mitigating reputational damage, brand harm, and broader national security risks that often accompany such attacks. Analyst1 continues to monitor the hacktivist landscape.
About Analyst1
Threat intelligence teams often struggle to bridge the gap from insight to action. Analyst1 is the Orchestrated Threat Intelligence Platform designed to resolve this issue. It automatically organizes threat data, links it to your assets and vulnerabilities, and customizes views for different roles. Analyst1’s orchestration layer streamlines workflows and automates reliable actions by integrating with SIEM, ticketing, and vulnerability management systems. From Fortune 500 financial institutions to national security agencies, enterprises trust Analyst1 to unify their defenses, significantly reducing their response time from days to minutes.
