Anonymous Hackers Fire ‘Warning Shot’ at Companies Refusing to Pull Out of Russia

Anonymous hacktivists warned that the next #OpRussia target will be corporations that refuse to pull their business from Russia as one group of hackers decided to try to use their data haul from a Russian company to financially help the people of Ukraine.

“We call on all companies that continue to operate in Russia by paying taxes to the budget of the Kremlin’s criminal regime: Pull out of Russia! We give you 48 hours to reflect and withdraw from Russia or else you will be under our target!” a prominent Anonymous account tweeted Sunday.

The same account reported Thursday that the #OpRussia cyber offensive started nearly a month ago by the collective was “launching unprecedented attacks on the websites of Russian gov’t. Increasing their capacity at peak times from 500 GB earlier, it is now up to 1 TB. That is, two to three times more powerful than the most serious incidents.”

And one hacker who has promised for days a major data dump tweeted that they were first expecting a reply on a ransom request — stressing that if the ransom was paid it would not be lining their pockets but would be donated as “free money for Ukraine.”

That same hacker, going by the Twitter handle DepaixPorteur, participated in a Sunday operation organized by Anonymous Strategic Support and #OpRedScare to print out messages on hijacked printers countering Russian propaganda about the war along with instructions on how to install the Tor browser to evade government censors. Fifteen people working on the project were able to send more than 100,000 copies to printers across Russia in two hours, the account announced.

On March 13, DepaixPorteur teased on Twitter that a “huge” data dump was forthcoming “that’s gonna blow Russia away,” adding the following day that they have “hundreds if not thousands of gigabytes of data to compile.” Throughout the #OpRussia cyber campaign, hackers have frequently posted data from their intrusions into government and company systems, ranging from phone lists up to giant troves of sensitive data.

On March 18, the hacker tweeted about the effort to extract ransom from the hacked entity: “So we’ve decided we’re going to ransom this Russian company for their data before we dump it, and if they pay, we will donate it to #Ukraine @ukraine‘s ethereum address. That way Russian corporations will be paying Ukraine, to fight themselves… To people who are saying ‘they won’t pay, they have backups’. We don’t care. Money wasn’t our initial intention anyway. We’re happy to dump the data for free. But if they do pay, it’s free money for #Ukraine. Also we’re encrypting their data and deleting backups :)”

“Yes we’re still going to dump the data we’ve been hyping all week. It’s fucking HUGE, but we’re waiting for a ransom response before we dump it. Appreciate your guys patience! Going to need all the help we can translating it after it dumps,” the account tweeted Sunday, adding, “Why would it matter if they pay or not if we plan on dumping it anyway? If they pay, cool free money for #Ukraine, if not then we still dump it as planned.”

The hacker announced the previous weekend that they had conducted penetration testing on 14,000 cameras around Kyiv — because “if we can, the Russians can as well” — and found vulnerabilities in 300. “We’ll bring this to the attention of #Ukraine IT as soon as possible. But it’s a lot better than we were expecting,” they tweeted, adding that they would be moving on to doing pentesting for other major Ukrainian cities’ cameras too.

Anonymous called for a worldwide boycott of Nestle products, claiming attacks on the company’s sites over the past few days — and “that was only a warning shot” — after the company, which has more than 7,000 employees in Russia, said in a March 11 statement that they would “continue to do our utmost to ensure a reliable supply of safe and essential food products for the local people.” Nestle is far from the only company that has decided to keep a foothold in Russia; for example, pizza chain Papa John’s said it would suspend corporate operations in the country but a U.S. franchise operator said 190 stores in Russia would remain open because “at the end of the day, they appreciate a good pizza.”

Bridget Johnson

Bridget Johnson is the Managing Editor for Homeland Security Today. A veteran journalist whose news articles and analyses have run in dozens of news outlets across the globe, Bridget first came to Washington to be online editor and a foreign policy writer at The Hill. Previously she was an editorial board member at the Rocky Mountain News and syndicated nation/world news columnist at the Los Angeles Daily News. Bridget is a terrorism analyst and security consultant with a specialty in online open-source extremist propaganda, incitement, recruitment, and training. She hosts and presents in Homeland Security Today law enforcement training webinars studying a range of counterterrorism topics including conspiracy theory extremism, complex coordinated attacks, critical infrastructure attacks, arson terrorism, drone and venue threats, antisemitism and white supremacists, anti-government extremism, and WMD threats. She is a Senior Risk Analyst for Gate 15 and a private investigator. Bridget is an NPR on-air contributor and has contributed to USA Today, The Wall Street Journal, New York Observer, National Review Online, Politico, New York Daily News, The Jerusalem Post, The Hill, Washington Times, RealClearWorld and more, and has myriad television and radio credits including Al-Jazeera, BBC and SiriusXM.

See Full Bio