Cardinal

Cardinal is a threat actor tracked in the provided content as both a cybercrime group associated with Black Basta ransomware activity and as a pro-Russian hacktivist actor participating in politically motivated operations. Symantec and the Carbon Black Threat Hunter Team track the group as Cardinal and state that Black Basta was developed by this group. In recent Black Basta activity, Cardinal was linked to a campaign that embedded a bring-your-own-vulnerable-driver (BYOVD) capability directly into the ransomware payload. The malware dropped the signed but vulnerable NsecSoft NSecKrnl kernel driver, created a service to run it, and abused CVE-2025-68947 to send malicious IOCTL requests that terminated protected security processes, including SophosHealth.exe and MsMpEng.exe, before encrypting files and appending the .locked extension. Reporting also noted a suspicious side-loaded loader observed weeks before ransomware deployment, suggesting possible long dwell time. The content states Cardinal went relatively quiet after internal Black Basta chat logs leaked in early 2025 or February 2025. The content also describes Cardinal as a pro-Russian hacktivist group. Cardinal led the newly formed Russian Legion alliance, publicly announced on January 27, 2026, together with The White Pulse, Russian Partizan, and Inteid. In that role, Cardinal was involved in OpDenmark, a coordinated campaign threatening and conducting DDoS attacks against Danish companies and public organizations to pressure Denmark over military aid to Ukraine. The alliance used Telegram-based threats, screenshots of disrupted sites, and warnings that DDoS was only the beginning of broader cyberattacks. Truesec assessed Russian Legion as likely state-aligned but not state-funded. Separately, pro-Russian hacktivist groups Cardinal and Russian Legion claimed to have breached Israeli military networks, including the Iron Dome missile defense system, and Cardinal claimed to have targeted Israel Defense Forces systems and publicly leaked stolen information. Known aliases and associated names directly mentioned in the content include only Cardinal. Sub-groups or allied groups directly mentioned are The White Pulse, Russian Partizan, and Inteid as members of Russian Legion.