Researchers have uncovered new hacking tools used by the pro-Ukraine hacktivist group Hacking Cat, which has evolved from carrying out website defacements and data leaks to more sophisticated and destructive attacks on Russian targets.

The group often works alongside other Ukraine-linked hackers and uses a wide range of custom-built tools, making it “significantly more difficult” to attribute individual attacks to a specific threat actor, Russian cybersecurity firm Kaspersky said in a recent report.

Hacking Cat has been attacking Russian organizations since around February 2024, and by the summer of 2025 began shifting toward operations designed to encrypt and destroy data.

Kaspersky said it discovered two malware families in attacks linked to the group: a previously undocumented remote-access tool dubbed Gorilla RAT and Monkey Ransomware, which according to previous reports encrypts user data and adds the “.monkey” extension to affected files.

In some attacks, the hackers exploited vulnerabilities in Microsoft Exchange servers to gain an initial foothold before deploying Gorilla RAT. The custom tool can tunnel network traffic, allowing attackers to remotely access systems inside a victim’s network.

Researchers also discovered numerous variants of Monkey Ransomware on systems compromised in attacks attributed to Hacking Cat. The malware first appeared in late summer or early fall 2025, but the attackers tweaked it over the following months, deploying variants written in different programming languages.