Anonymous-affiliate Discord leak spells bad news for Russia

Anonymous-affiliated hackers have amassed vast amounts of data on Russian assets: from X (formerly Twitter) accounts disseminating propaganda, to the Russian space agency, Roscosmos. Cybernews got a sneak peek at some of the contents.

Discord, the popular instant messaging and call platform, has become a hacker favorite. For example, a group affiliated with the Anonymous collective uses the platform to share data on targets in Russia and coordinate attacks.

“Everyone, let’s mess up the Russian internet in Crimea and also take some Russian airline systems down,” reads an attackers’ message on the Discord server. It’s followed by names of targeted internet providers and a data leak from several Russian airlines.

The share volume of data attackers collected from various Russian sources appears to be humongous. While some of the information comes from data leaks, other pieces were gathered using Open-Source Intelligence (OSINT) methods.

The shared data includes hundreds of dedicated folders: some named after specific organizations, for example, “Roscosmos.” Meanwhile, others hold information on Russian TV outlets, various individuals, and state-affiliated companies.

One folder, whose contents Cybernews has seen, is titled “Leaked data of corrupt officials,” implying that its contents pertain to Russian officials.

Other, more technical info includes data about vulnerable, meaning accessible, Russian CCTV cameras, an invaluable asset to anybody who wants to plan behind-enemy-line attacks or follow the movement of Moscow’s military assets.

Anonymous-affiliated hackers take a keen interest in pro-Russian attackers such as members of the Killnet group. Parts of the shared information expose Russia’s critical infrastructure and the social media accounts of prominent Russian public figures.

Notable names include Maria Zakharova, the Director of the Information and Press Department of the Russian Ministry of Foreign Affairs, and Margarita Simonyan, head of the state-controlled broadcaster RT.

The Cybernews research team noted that the website of the President of the Russian Federation is still hosted by cybersecurity firm Kaspersky, implying it still has connections with the Russian state, despite trying to distance itself from Moscow after February 2022.

The servers’ contents also suggest that Anonymous-affiliated hackers take a particular interest in social media accounts that, according to their view, disseminate Russian propaganda. The information includes data on pro-Russian accounts on the X platform, Instagram, and other social media accounts.

“While some data comes from public sources, people involved in acquiring it undoubtedly collate different data points to carry out targeted attacks on organizations and individuals. Attackers can easily use the type of data shared in the Discord server for an initial stage of the cyberattack,” the Cybernews research team said.

Various hacktivist groups have been actively involved in Russia’s war in Ukraine since Moscow launched a full-scale invasion of its neighbor back in February 2022. The hacking group Anonymous has declared a cyberwar on Russia in response to its attack on Ukraine.

Discord has been favored by people who want to share information in closed groups for years. Earlier this year, the platform caught headlines over 21-year-old National Guardsman Jack Teixeira leaking classified US defense documents on the platform.