Cyberattack News

#FreeDurov – Hacktivists Rally On Telegram For CEO Pavel’s Release

The events surrounding Pavel Durov’s arrest on 24 August 2024 due to Telegram’s suspected operational crimes worsened discussions on topics such as digital privacy, end-to-end encryption, and the responsibility of online platforms.

This case also demonstrates the clash between the police and secure messaging applications.

Pavel Durov is viewed in hacktivist circles as the creator of both Vkontakte (VK) and Telegram, so why is there such a controversy surrounding the MTProto encryption protocol and Telegram’s cloud storage architecture?.

In the past, VK was significant mainly due to the provision of the API and lack of moderation of the content, which unintentionally enabled the creation of a network.

It has raised questions about the security of messaging apps due to possible backdoors and revived the debate about national security versus user privacy in the modern world.

The #FreeDurov – Hacktivists Rally

Telegram, owing to its minimal moderation and Durov’s libertarian approaches, quickly became a center for pro-Russian hacktivists such as UserSec, People’s Cyber Army, and CyberDragon groups. 

Here below we have mentioned all the names of key Russian hacktivist groups and their allies:-

  • People’s Cyber Army
  • UserSec
  • CyberDragon
  • EvilWeb
  • Rootsploit
  • CGPlnet
  • Overflame
  • ReconSploit
  • RipperSec
  • 62IX (did not actively participate but supported #freedurov campaign)
  • High Society (alliance)
  • Holy League (alliance)

Durov’s arrest in France on 24 August 2024 gave birth to the #FreeDurov and #OpDurov movements which brought together previously conflicting factions of Russian society.

This also led to a rash of Denial of Service (DOS) attacks and claims of attacks against French and EU computer networks and systems.

Coordinated cyber-attacks by several hacktivist groups on French websites (Source – Cyble)

It is significant to note that UserSec has also been responsible for attacks against the French Court of Cassation and the Administrative Court of Paris, whereas the People’s Cyber Army hacked Industrial Control Systems (ICS) at the wind farm Parc Eolien de Tenbonrev, based in Brittany, and operated the power transmission Control panels.

The orchestrated attack was not limited to only terrorist organizations’ actions and infrastructural interdependencies but also included their coordinated strikes against airports, ferry services, the financial structures of the AXA Group, or educational structures such as the Agence Universitaire de la Francophonie (AUF), demonstrating the hacktivists’ capacity for multi-vector attacks against critical infrastructure.

UserSec and People’s Cyber Army claim responsibility for the Attack on AXA France (Source – Cyble)

The mid-August 2024 leak of the “Kordon 2023” FSB Border Service database on Telegram channels exposed Pavel Durov’s 50+ trips to Russia during 2014-2023, rejecting his claimed severance from the country.

One of the leaks containing the above information occurred just before Durov’s arrest in Paris, and it’s worth pointing out that during one such visit, Roskomnadzor lifted the ban on Telegram.

This incident prompted the rise of the #FreeDurov campaign, and the campaign enlisted pro-Russian, pro-Palestinian, and French hacktivists on Telegram.

This incident illustrates the conflict between the national authority’s requirements concerning content regulation and the users’ right to privacy in the context of social networking services. It may have repercussions on digital communication and the protection of users’ communication in the future.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14 day free trial

Cyber Advisory

CISO Advisory is a Team of Security Experts Covering Various Cybersecurity Research and Technical Write-ups.

Recent Posts

Hackers Target AI Infrastructure With RCE, Prompt Injection and API Key Theft

Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…

2 hours ago

Hackers Make Phishing Pages Change Their Code Every Time Someone Opens Them

Hackers are making some phishing pages harder to track by changing the code delivered to…

2 hours ago

Iran-Linked Hackers Reportedly Knock UK Power Plant Offline for Four Days

A cyber incident reportedly forced a British power plant to halt operations for about four…

3 hours ago

Russian Hackers Use New HOOKEDGE Malware to Spy on European Defense and Diplomatic Targets

Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…

3 hours ago

Ransomware Gang Claims AI Can Analyze 700GB of Stolen Data Every Hour

TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…

4 hours ago

Hackers Compromise Hundreds of WordPress Sites to Deploy Amatera Stealer via ClickFix

A fake student resume is being used to place a remote-access tool on researchers’ Windows…

5 hours ago