Twelve

Twelve is a pro-Ukrainian hacktivist threat actor that emerged in April 2023 in the context of the Russia-Ukraine war and has primarily targeted Russian government entities and other organizations in Russia. The group is known for destructive intrusions that combine data theft, public disclosure, ransomware-style encryption, and subsequent wiping activity intended to maximize operational disruption and hinder recovery. Its behavior indicates a sabotage- and reputational-impact focus rather than a conventional profit-driven extortion model. Twelve commonly relies on valid accounts for initial access, including abuse of local or domain credentials and VPN or SSH certificates. Multiple intrusions indicate the group has exploited trusted third parties and contractors as access paths into downstream victims. Observed tradecraft also includes exploitation of VMware vSphere vulnerabilities such as CVE-2021-21972 and CVE-2021-22005 to compromise vCenter infrastructure and deploy the FaceFish backdoor. The actor heavily uses publicly available and commodity post-exploitation tooling rather than bespoke malware. Reported tools and techniques include Cobalt Strike, Mimikatz, BloodHound, PowerView, adPEAS, CrackMapExec, PsExec, PowerShell, web shells, and tunneling utilities such as ngrok. Twelve has used Remote Desktop Protocol extensively for lateral movement, performed Active Directory manipulation for persistence and privilege escalation, harvested credentials from LSASS, registry hives, and NTDS data, and conducted broad internal reconnaissance before staging final payloads. Defense evasion has included masquerading of malware and scheduled tasks as legitimate software or services, clearing event logs, and removing forensic artifacts. For collection and exfiltration, Twelve has stolen sensitive organizational data including internal communications, financial and technical documents, and messaging-session data, then publicized compromises through its Telegram presence. For impact, the group has deployed LockBit 3.0-derived ransomware and Chaos-derived variants, often distributing them domain-wide through Group Policy, scheduled tasks, administrative shares, and PowerShell. It has also used Shamoon-like wipers to overwrite file contents and boot records, making restoration difficult or impossible. Twelve has notable operational overlap with several other Russia-targeting clusters. Researchers have identified shared infrastructure, tooling, and procedures with DARKSTAR, also known as COMET or Shadow, suggesting possible common operators, a shared syndicate, or a broader activity cluster. Additional overlaps have been reported with Head Mare, BlackJack, Crypt Ghouls, MorLock, and Shedding Zmiy (ExCobalt), including shared use of CobInt-related tooling, credential-harvesting utilities, remote administration tools, and similar deployment patterns for ransomware and destructive payloads. Head Mare in particular has been assessed as likely collaborating with Twelve based on previously exclusive command-and-control infrastructure and malware overlaps. Known aliases and related names include Twelve, -=TWELVE=-, and possible associations with DARKSTAR, COMET, and Shadow at the cluster level. Twelve is best characterized as a destructive hacktivist actor within the ecosystem of groups conducting anti-Russian cyber operations.