Photo: Kirill Kallinikov / RIA Novosti
According to the Telegram channel Mash, the recent large-scale cyberattack on Russian resources was orchestrated by the Hacken group. The channel also identified specific individuals allegedly involved in these activities.
Hacken is described as an international cybersecurity company with Ukrainian roots. In March 2022, it secured multi-million dollar investments from American investors. Since the start of the special military operation, the group has been actively involved in cyber warfare against Russia. Its headquarters are located in Tallinn, Estonia, while the core team, relocated from Ukraine in March 2022, is based in Lisbon, Portugal. As of July 2025, the group comprises 110 members, 60 of whom are in Ukraine.
It is noted that the de-anonymization of the hackers was made possible through cooperation with other groups, such as KillNet and Beregini. Mash published a list of alleged perpetrators of the attack but did not provide additional evidence of their involvement. The named individuals include Dmitry Budorin (Hacken CEO), Sergey Dovgopoliy (CTO), Alexander Gorlan (information security expert), Denis Ivanov (head of the expert group at the Ministry of Digital Transformation of Ukraine), as well as Evgeny Bezugly from Kyiv and Evgenia Broshevan from Odesa.
The primary tools for these attacks were identified as standard DDoS attacks, supplemented by the use of an infected stealer – a malicious program designed to steal data, which had previously been widely distributed across the Russian internet segment.
Mash also noted that “inexperienced hackers” from the Anonymous group were enlisted to support the attacks on Russian resources. Anonymous is known for declaring cyberwarfare against Russia in February 2022 and making claims about fake hacks.
Throughout July, several major Russian companies became targets of hacker attacks. On July 29, the pharmacy chains Stolichki and Neopharm, along with the Family Doctor clinic network, reported outages. The day before, on July 28, Aeroflot fell victim to a cyberattack, and on July 14, hackers disrupted the operations of the Winlab alcohol retail chain.
