CyberBerkut (Russian: КиберБеркут, Ukrainian: КіберБеркут)—is a modern organized group of pro-Russian hacktivists. The group became locally known for a series of publicity stunts and distributed denial-of-service (DDoS) attacks on Ukrainian government, and western or Ukrainian corporate websites. WHOIS query reveals that they have been using San Francisco based CloudFlare services via Whois Privacy Corp. registered in Nassau, Bahamas to hide their identity.
The group emerged after the dissolution of special police force "Berkut" that came as a consequence of the violent repression used during the EuroMaidan demonstrations. Composition is not known, for obvious reasons members of the community tend to remain anonymous, one of many groups visible only in social networks. Their proclaimed goals are fighting against neo-fascism, neo-nationalism and arbitrary power in Ukraine. To further this aim, CyberBerkut activists targeted the "Right Sector" IT resources. CyberBerkut's symbols resemble that of the Anonymous group. The prefix "cyber" probably alludes to working in the cyberspace (the Internet). CyberBerkut's targets have included NATO and its allies.
Attacks on NATO websites.
Attacks on U.S. private military companies.
Publication of correspondence of deputies of (political parties) Batkivshchyna and Ukrainian Democratic Alliance for Reform.
Publication of correspondence with the United States Embassy in Ukraine and United States foundations.
Disclosure to public of telephone recording between Yulia Tymoshenko and Nestor Shufrych.
Disclosure to public of telephone recording between EU High Representative for Foreign Affairs Catherine Ashton and Foreign Minister of Estonia Urmas Paet.
Blocking cellular phones of members of the Yatsenyuk Government and persons close to them.
Blocking Internet resources of Secretary of the National Security and Defence Council of Ukraine Andriy Parubiy and news portals: LigaBusinessInform and Ukrainian Independent Information Agency.
Publication of video materials that are blocked on YouTube.
Attempts at disrupting the recruitment of the National Guard of Ukraine.
Attempted destruction of the electronic system of the Central Election Commission of Ukraine prior to the 2014 Ukrainian presidential election.
Publishing lists of alleged Ukrainian military deserters
Attempts at disrupting the work of the Central Election Commission of Ukraine by damaging the IFES system before the elections and blocking cellphones of their organisators.
Temporary disruption of the websites of the Ministry of Internal Affairs and the General Prosecutor of Ukraine. Websites of TV channels 1+1 and Inter were also temporary disrupted.
Email hacking and publication of the conversation between Ihor Kolomoyskyi and the persecutor of the Lviv Oblast, hacking of the computer and email of a person related to Ihor Kolomoyskiy. Archives of the contents of 89 email accounts of Lviv oblast's prosecutor office employees.
Hacking and publishing of the Minister of Internal Affairs Arsen Avakov's conversation.
Blocking of the website of the President of Ukraine Petro Poroshenko on June 29, 2014.
Publication of the real name and biography of Semen Semenchenko – Konstantin Grishin.
Hacking of commercial billboards in Kiev and broadcasting footage over them with the accusal of some candidates in the parliamentary election as war criminals.
Hacking of the German Chancellery and the German Bundestag
Repeated blocking of CB's Facebook pages, although new ones have been made on the following day.
Likely in response to attacking the websites of Greystone Limited and Triple Canopy, CyberBerkut's websites have been temporarily disrupted. The websites started to work again on the following day.
Arrests of people suspected in relation to CyberBerkut.
