The Russian invasion of Ukraine has split the hacking community, sending some of the most recognizable and powerful groups scrambling to pick a side to declare which has their allegiance.

In a tweet, hacking group Anonymous declared "a cyberwar against the Russian government" and has claimed to be responsible for attacks that brought down Russia Today, a state-backed news outlet, and several government websites. It also said it hacked other Russian state-TV channels.

Conti, a ransomware group with possible ties to Russian intelligence that attacked more than 290 American targets last year, declared its "full support of Russian government" and said it would use "all possible resources to strike back" at any adversaries. Cyberthreat intelligence company Orpheus Cyber reported another group united with Russia obtained stolen data from more than 45 Ukrainian government websites, and some of it is up for sale.

Motives that push hacking groups to pick a side range widely. Members of Anonymous have stated that their guiding principle is "anti-oppression," while Russian-aligned attacks may be state-sponsored. Pro-Russia attacks can also come from groups who feel pressured to operate on their behalf by the Kremlin.

"It's not entirely clear what the connection is between the ransomware gangs and the Russian government," said Brett Callow, a threat analyst at Emsisoft. "At best, they are working within a permissive environment. At worst, they are working for certain wings of the Russian government."

"Some of the actions of Russia's government just prior to the war — shutting down the REvil gang or arresting them and shutting down a number of dark web forums and shops — these cybercriminals are afraid that if they don't support the regime, they're going to be next," said Alex Holden, the founder of Hold Security.

Hacking groups may become targets for moving away from their usual financial motives for attacks. After Conti declared support for Russia, an apparent insider who objected to the group's support for Russia leaked a trove of internal chat messages and other files that Holden says "mortally wounded" the gang.

"When we see things like this, we are learning how in 2021, 2022, cybercriminal enterprises operate, so we have [the] ability to detect and deter organizations like this in the future," Holden said.

Moving forward, experts say that any further cyber escalation could spell trouble for those outside the conflict zone, including Americans. Groups like Conti could come back to hit the U.S. as well.

"They are a highly effective ransomware group, albeit one that has terrible operational security," Callow said. "They likely do still have access to certain U.S. networks that they have yet to encrypt, and they could potentially do that any time."

Newsy is the nation’s only free 24/7 national news network. You can find Newsy using your TV’s digital antenna or stream for free. See all the ways you can watch Newsy here: https://bit.ly/Newsy1

---

Trending stories at Newsy.com

A web hosting company that has provided services to several controversial right-wing websites has confirmed that it has been hacked. CNN and The Washington Post report that the information has been made public by hacking collective Anonymous.

CNN and The Post report that 150 gigabytes of previously private data have been made public. Experts believe that the massive hack could shed more light on the far-right groups that attempted to overturn the 2020 presidential election and or advocate for violence against certain racial and ethnic groups.

The hosting company, Epik, has made a name for itself by providing web hosting capabilities to far-right groups who have been kicked offline by other companies who refuse to host their hateful content.

In recent years, Epik has provided hosting services to 8chan (a website that hosted the racist manifesto of a gunman who killed 51 people at a mosque shooting in New Zealand), Gab (a social media site that hosted the antisemitic rants of the Pittsburgh synagogue gunman) and Parler (an app on which some users coordinated the Jan. 6 riot at the Capitol).

Epik was also in the news earlier this month for providing hosting capabilities to the Texas Right to Life's "Abortion Whistleblower" page — an online form that was ultimately removed because Epik said it violated its terms of service.

On Sept. 13, independent journalist Steven Monacelli was the first to report that the hackers had stolen the private information about Epik's clients. Days later, Epik confirmed that "certain customer information for our domain-related systems was accessed and downloaded by unauthorized third parties."

According to The Post and CNN, Anonymous has taken credit for the hack. The internet vigilantes are known for conducting political activism through cyberhacking.

The Post adds that since the hack, Epik's security protocols "have been the target of ridicule among researchers" who say the company failed to take basic security precautions.

CNN spoke to experts who said that researchers would spend "months" pouring over the now-public data. They say the hack will likely provide new insight into the far-right ecosystem and the leaders of many of the U.S.'s most prominent hate groups.