Cyberpartisans and Silent Crow claimed they hacked Rosstat, controlled about 25,000 computers, copied around 23 TB of data, and destroyed internal IT infrastructure.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Unclassified

Summary

Silent Crow stated on its Telegram channel that a joint operation with Belarusian Cyberpartisans gave them access to a large part of Rosstat's infrastructure, including the central apparatus, regional offices, and the Main Interregional Center for Processing and Dissemination of Statistical Information. The groups claimed around 25,000 computers came under their control, along with access to network management servers and ZVIRT, oVirt, and VMware ESXi virtualization systems. They said copied materials included an electronic document management system, statistical, economic and personal databases, census materials, internal documents, and data from employees' work computers. They also claimed the trove included information related to Russian military losses in Ukraine, but did not specify the exact content or time period. About 2 TB allegedly came from infrastructure containing materials marked 'For official use,' while the total copied data volume was estimated at about 23 TB. The groups also claimed destruction of Rosstat's internal IT infrastructure. The article notes that Silent Crow and Cyberpartisans had previously announced joint operations, including a claimed Aeroflot IT systems hack at the end of July 2025.

Classification

Confidence: High

The primary subject is a reported cyber intrusion, data exfiltration, and destructive action against a Russian state agency, so it fits HYBRID_SIGNAL under Cyber & Information Warfare. It is not classified as an aggressor signal because the reported actors are Belarusian Cyberpartisans and Silent Crow targeting Russian state infrastructure, rather than hostile aggressor activity by Russia or an aligned state/proxy against another country.

Source URL

https://nashaniva.com/408074

Open source

Provenance

Publisher: extension
Submitted: Nov 1, 2026, 18:23 UTC
Last updated: Nov 4, 2026, 02:48 UTC
Event time: Nov 1, 2026, 12:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "13b68c65-2c69-44cc-94e3-076e998d6815",
  "url": "https://nashaniva.com/408074",
  "source": "extension",
  "status": "processed",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Russian Federation",
  "source_reliability": "F",
  "info_credibility": "6",
  "tags": [
    "Rosstat",
    "Cyberpartisans",
    "Silent Crow",
    "Russia",
    "russia–ukraine war",
    "cyber operation",
    "data theft",
    "government systems",
    "destructive cyber activity",
    "military casualty data",
    "virtualization systems",
    "ZVIRT",
    "oVirt",
    "VMware ESXi"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Belarusian Cyberpartisans and the hacker group Silent Crow claimed a joint cyber operation against Russia's Federal State Statistics Service, Rosstat. According to the claim reported by Nasha Niva, they hacked and destroyed Rosstat's internal IT infrastructure, copied about 23 terabytes of information, and obtained data allegedly related to Russian military losses in the war against Ukraine. The claimed access covered Rosstat's central office, regional subdivisions, and the Main Interregional Center for Processing and Dissemination of Statistical Information.",
  "summary_short": "Cyberpartisans and Silent Crow claimed they hacked Rosstat, controlled about 25,000 computers, copied around 23 TB of data, and destroyed internal IT infrastructure.",
  "summary_extended": "Silent Crow stated on its Telegram channel that a joint operation with Belarusian Cyberpartisans gave them access to a large part of Rosstat's infrastructure, including the central apparatus, regional offices, and the Main Interregional Center for Processing and Dissemination of Statistical Information. The groups claimed around 25,000 computers came under their control, along with access to network management servers and ZVIRT, oVirt, and VMware ESXi virtualization systems. They said copied materials included an electronic document management system, statistical, economic and personal databases, census materials, internal documents, and data from employees' work computers. They also claimed the trove included information related to Russian military losses in Ukraine, but did not specify the exact content or time period. About 2 TB allegedly came from infrastructure containing materials marked 'For official use,' while the total copied data volume was estimated at about 23 TB. The groups also claimed destruction of Rosstat's internal IT infrastructure. The article notes that Silent Crow and Cyberpartisans had previously announced joint operations, including a claimed Aeroflot IT systems hack at the end of July 2025.",
  "actor_primary": "Belarusian Cyberpartisans",
  "target_primary": null,
  "location_text": "Rosstat IT infrastructure, Russia",
  "location_region": null,
  "location_coordinates_lat": 61.52401,
  "location_coordinates_lon": 105.318756,
  "location_precision": "Regional",
  "is_aggressor_signal": false,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The primary subject is a reported cyber intrusion, data exfiltration, and destructive action against a Russian state agency, so it fits HYBRID_SIGNAL under Cyber & Information Warfare. It is not classified as an aggressor signal because the reported actors are Belarusian Cyberpartisans and Silent Crow targeting Russian state infrastructure, rather than hostile aggressor activity by Russia or an aligned state/proxy against another country.",
  "event_time_utc": "2026-11-01T12:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-11-01T18:23:00.034Z",
  "updated_at": "2026-11-04T02:48:19.132Z",
  "reliability_band": "pattern",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_basis": "single_source"
}

Public assessmentReliability: Pattern fitSeverity: SignificantSingle sourceTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Nov 1, 2026, 12:00 UTC

Event time confidence

unknown

Location

Rosstat IT infrastructure, Russia

Primary actor

Belarusian Cyberpartisans

Country

Russian Federation

Tags

Rosstat, Cyberpartisans, Silent Crow, Russia, russia–ukraine war, cyber operation, data theft, government systems, destructive cyber activity, military casualty data, virtualization systems, ZVIRT, oVirt, VMware ESXi

Loading signal...

{ "id": "13b68c65-2c69-44cc-94e3-076e998d6815", "url": "https://nashaniva.com/408074", "source": "extension", "status": "processed", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Russian Federation", "source_reliability": "F", "info_credibility": "6", "tags": [ "Rosstat", "Cyberpartisans", "Silent Crow", "Russia", "russia–ukraine war", "cyber operation", "data theft", "government systems", "destructive cyber activity", "military casualty data", "virtualization systems", "ZVIRT", "oVirt", "VMware ESXi" ], "nodes": [], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "Belarusian Cyberpartisans and the hacker group Silent Crow claimed a joint cyber operation against Russia's Federal State Statistics Service, Rosstat. According to the claim reported by Nasha Niva, they hacked and destroyed Rosstat's internal IT infrastructure, copied about 23 terabytes of information, and obtained data allegedly related to Russian military losses in the war against Ukraine. The claimed access covered Rosstat's central office, regional subdivisions, and the Main Interregional Center for Processing and Dissemination of Statistical Information.", "summary_short": "Cyberpartisans and Silent Crow claimed they hacked Rosstat, controlled about 25,000 computers, copied around 23 TB of data, and destroyed internal IT infrastructure.", "summary_extended": "Silent Crow stated on its Telegram channel that a joint operation with Belarusian Cyberpartisans gave them access to a large part of Rosstat's infrastructure, including the central apparatus, regional offices, and the Main Interregional Center for Processing and Dissemination of Statistical Information. The groups claimed around 25,000 computers came under their control, along with access to network management servers and ZVIRT, oVirt, and VMware ESXi virtualization systems. They said copied materials included an electronic document management system, statistical, economic and personal databases, census materials, internal documents, and data from employees' work computers. They also claimed the trove included information related to Russian military losses in Ukraine, but did not specify the exact content or time period. About 2 TB allegedly came from infrastructure containing materials marked 'For official use,' while the total copied data volume was estimated at about 23 TB. The groups also claimed destruction of Rosstat's internal IT infrastructure. The article notes that Silent Crow and Cyberpartisans had previously announced joint operations, including a claimed Aeroflot IT systems hack at the end of July 2025.", "actor_primary": "Belarusian Cyberpartisans", "target_primary": null, "location_text": "Rosstat IT infrastructure, Russia", "location_region": null, "location_coordinates_lat": 61.52401, "location_coordinates_lon": 105.318756, "location_precision": "Regional", "is_aggressor_signal": false, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The primary subject is a reported cyber intrusion, data exfiltration, and destructive action against a Russian state agency, so it fits HYBRID_SIGNAL under Cyber & Information Warfare. It is not classified as an aggressor signal because the reported actors are Belarusian Cyberpartisans and Silent Crow targeting Russian state infrastructure, rather than hostile aggressor activity by Russia or an aligned state/proxy against another country.", "event_time_utc": "2026-11-01T12:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-11-01T18:23:00.034Z", "updated_at": "2026-11-04T02:48:19.132Z", "reliability_band": "pattern", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "significant", "attribution_basis": "single_source" }