Copyright © 2024

The work of Euromaidan Press is supported by the International Renaissance Foundation

When referencing our materials, please include an active hyperlink to the Euromaidan Press material and a maximum 500-character extract of the story. To reprint anything longer, written permission must be acquired from [email protected].

Privacy and Cookie Policies.

“We have no need for CIA help” – Ukrainian hackers of #SurkovLeaks | Exclusive interview

Sean (left) and Dahmer (right), RUH8 hacktivists. Photo: Euromaidan Press
“We have no need for CIA help” – Ukrainian hackers of #SurkovLeaks | Exclusive interview

On 25 October, the contents of the hacked mailbox of Vladislav Surkov, advisor to Russian President Vladimir Putin, made headlines all over the world. Known as #SurkovLeaks, the 1GB email dump of [email protected], apparently managed by his assistants, was confirmed to be authentic by the Atlantic Council’s Digital Forensic Lab and Bellingcat.

This first hack of a senior Russian officials’ mailbox gave additional evidence for the Kremlin’s extensive involvement in orchestrating and funding so-called “separatist” movement, and consequently, war in Ukraine’s Donbas. It serves as a good supplement for other proof of such evidence, like the Glazyev tapes and Informnapalm’s OSINT report on Russian military equipment in Donbas.

The Ukrainian hacking group CYBERHUNTA took responsibility for the hack.

CYBERHUNTA is part of the unofficial Ukrainian “Cyberalliance,” which also includes the groups FalconsFlameRUH8, and TRINITY.

However, many journalists and experts have voiced a theory of the CIA’s involvement in the hack, as promised “unprecedented cyber covert action against Russia” after the alleged Russian hacking of the Democratic party’s computer networks. We set theory aside and met in Kyiv with Dahmer and Sean, hacktivists from RUH8, the most media-welcoming representatives of the Cyberalliance, to find out more about the cyberwar, their plans, and what they think of the CIA and Wikileaks.

When was RUH8 created?

In mid-2014, somewhere around spring-summer. We had each our own skill sets at that time, being involved in information security. Then we understood that the government needs our help because there were no specialized departments in the security service or military intelligence. We saw they needed help with obtaining information.

Tell us how the war is manifest in cyberspace.

Cyberwar, or infowar, is a wide topic. We are involved in the technical aspects of this war.

What is this technical aspect?

Our main goal is to obtain full information and cause collateral damage to our enemies with the help of social engineering, special programs, or technical means.

Do you describe yourself as hackers or hacktivists? What’s the difference?

The term “hacker” is pretty diffuse. Journalists or information security products salespeople like to use it. I think we’re hacktivists first of all.

What is a hacktivist?

A hacktivist is a hacker who is working in the interests of his own country or social group. We’re working in the interest of our country.

What is your goal? Which interests of the country specifically are you working towards?

Our interests are written in the Constitution: each citizen of Ukraine must defend its independence and territorial integrity at all costs.

You are part of the “Cyberalliance.” Tell us about it

Cyberalliance is a quasi-organization with the participation of several groups – RUH8, Trinity, Falcon Flames, Cyberhunta. There are structures affiliated to the hackers – the Myrotvorets site, Informnapalm analytical agency.

How do you conduct your operations? Who does the planning?

Each unit in the Cyberalliance functions separately. It outlines and implements its own goals. But there are moments when we do act together – when somebody has special knowledge that will be useful for the whole team.

Hacktivists Ukraine Surkovleaks
Sean (left) and Dahmer (right), RUH8 hacktivists. Photo: Euromaidan Press

Are there any hacktivists outside of the “Cyberalliance” pursuing the same goal as you?

There are some, but they don’t make contact with us and don’t coordinate their actions.

What operations have you conducted before? Which are the most successful ones?

Our operations started back in 2014. Overall, it was about obtaining information about separatists and traitors who were on ORDLO territory. This data was passed over to our special services. We made a present for Vladimir Putin on his birthday in 2014…

What exactly?

Proclaimed him the independence of the Astrakhan Republic, so he would feel a bit of what we felt and keep feeling throughout three years already. We hacked Russia’s Channel 1, the Orenburg State Duma, [conducted] Op256th dayObtaining information, creating collateral damage, defacing sites. Creating problems.

Editor's note: Read more about the Cyberalliance's operations here.

The cyberalliance is known for conducting a range of hacktivist operations starting from 2014.

One of the early operations was on 7 October 2014, when the hacktivists broke into a number of “DNR” websites and defaced the site of the Duma of Russia’s Astrakhan Oblast to display its “decision” to secede from Russia.

Snapshot from the site of the Astrakhan Oblast Duma.

Apart from Surkov leaks, they have broken into the phone gadgets of  Motorola, a notorious Russian separatist warlord, obtaining evidence that his death was the result of an operation of the Russian special services. But they are most known for operations to destroy websites related to the separatist “republics” in Donbas and Russian propaganda sites. The operations, scheduled around memorable dates, include: #op256thDay (Programmer’s Day), #opDay28 (Ukraine’s Constitution Day, 17 sites destroyed), #opMay18 (on the eve of the Day of the deportation of the Crimean Tatars by Stalin, the commemoration of which the occupation government of Crimea has effectively prohibited for the third year in a row, the hackers displayed a forged message from Sergey Aksenov, the puppet governor of Crimea, on an official website. In it, the pseudo-Aksenov stated that he is looking forward to Eurovision being hosted in the Ukrainian Crimea), #opMay9, in which nine “DNR” propaganda sites streamed videos about the Ukrainian contribution to t, he victory over Nazism on Victory Day.

On 29 April 2016, the Cyberalliance released a video addressed to the administrators of the websites they destroyed, urging them to stop using the “information space for lies and terror,” and to Ukrainians: “Support each other. Together we are a force that will win the war against the vile and deceitful enemy.”

Do you have a Code of Honor? Your group, the “Cyberalliance”?

Yes we do, and you’ll be surprised – it’s grounded on universal human qualities. Honor, dignity, but in an amplified state.

Some journalists have assumed that you are affiliated with Ukraine’s security service (SBU). Could you please comment on that?

We’re not affiliated with the SBU in any way, except for us giving their specialized departments some information that we obtain. Either to the SBU or the military intelligence.

The DNC hack in the USA is considered to be a Russian government operation. Did we have any such Russian operations against Ukraine?

Well, there are some, but they weren’t very publicized. For instance, “Yarosh’s card” from the elections [in which Ukraine’s central elections committee servers were hacked to briefly show the faked victory of the far-right candidate Dmytro Yarosh, a picture widely circulated on Russian TV, which pedals the Kremlin myth of the “fascist junta” ruling in Ukraine at any possible occasion – Ed.]. Or the Ivano-Frankivsk blackout [on 23 December 2015 – Ed.]. The Cyberberkut…

Sean (left) and Dahmer (right), hacktivists from RUH8. Photo: Euromaidan Press
Sean (left) and Dahmer (right), hacktivists from RUH8. Photo: Euromaidan Press

Some western experts assumed that the Surkov leaks were a result of the USA’s special services helping Ukrainian hackers as revenge for the DNC leak. Could you comment on that?

Let’s understand that Ukrainian hackers and Russian hackers once constituted a single very powerful group. Ukrainian hackers have a rather high level of work. So the help of the USA… I don’t know, why would we need it? We have all the talent and special means for this. And I don’t think that the USA or any NATO country would make such sharp movements in international politics.

When will you host the dump for “Shatun” operation?

A bit later, but soon. Cyberhunta is managing this question. [“Shatun” is an alleged Kremlin operation to destabilize Ukraine to provoke early parliamentary and presidential elections, as well as separatism in Ukraine’s regions. While Cyberhunta published scans describing the operation on their site, describing them as having originated from Surkov’s mailbox, no corroborating evidence has yet been provided – Ed.] 

Is it possible to forge a dump of a mailbox? What should journalists pay attention to?

Each email has its unique digital signature which is generated as a result of many criteria. It’s like a fingerprint – unique for each user. You can fake an image, a text document, but we know that there exist many organizations which deal with establishing the authenticity of those. I wish them luck.

What do you think of Wikileaks? Have you offered to host Surkovleaks there?

No, we didn’t offer them that, I don’t see any sense in this. We have our own analytical organizations, like Informnapalm, which does a good job at this. In my opinion, Wikileaks lost its moral-ethical code, which it had at the beginning.

Till when do you plan to work?

I don’t know, till the end of the war?

Till the victory?

Till the victory. And then we’ll see. Maybe we’ll start a civic movement. Or maybe we’ll just do our own things.

Voices have been manipulated for the sake of anonymity. Euromaidan Press extends its deepest gratitude to the Informnapalm community for help in organizing the interview.
You could close this page. Or you could join our community and help us produce more materials like this.  We keep our reporting open and accessible to everyone because we believe in the power of free information. This is why our small, cost-effective team depends on the support of readers like you to bring deliver timely news, quality analysis, and on-the-ground reports about Russia's war against Ukraine and Ukraine's struggle to build a democratic society. A little bit goes a long way: for as little as the cost of one cup of coffee a month, you can help build bridges between Ukraine and the rest of the world, plus become a co-creator and vote for topics we should cover next. Become a patron or see other ways to support. Become a Patron!

To suggest a correction or clarification, write to us here

You can also highlight the text and press Ctrl + Enter

Please leave your suggestions or corrections here

    Euromaidan Press

    We are an independent media outlet that relies solely on advertising revenue to sustain itself. We do not endorse or promote any products or services for financial gain. Therefore, we kindly ask for your support by disabling your ad blocker. Your assistance helps us continue providing quality content. Thank you!