SHUM

New publication. Cadet Blizzard.

Mon, 03 Aug 2026 00:00:00 +0000

Cadet Blizzard: When Cyber Espionage Becomes Cyber Sabotage

Some threat actors steal information. Others are built to disrupt, destroy, and support broader military objectives.

Cadet Blizzard (also tracked as Ember Bear and DEV-0586) belongs to the latter category. Widely linked by leading cybersecurity organisations to GRU Unit 29155, the group has become one of the key Russian cyber actors targeting Ukraine, NATO members, and organisations supporting Ukraine.

New publication. KillNet.

Mon, 06 Jul 2026 00:00:00 +0000

Our latest OSINT report focuses on KillNet.

KillNet has evolved far beyond a conventional hacktivist group. Our analysis shows that its campaigns consistently align with political developments and the geopolitical interests of the Russian Federation, while technical attacks are regularly combined with coordinated information and psychological operations.

Although most of its operations rely on relatively low-complexity techniques, KillNet remains one of the most influential pro-Russian cyber groups due to its ability to rapidly mobilize a broad network of supporters, coordinate large-scale DDoS campaigns, and amplify their impact through Telegram and other online platforms.

New publication. Ghostwriter (UNC1151).

Mon, 29 Jun 2026 00:00:00 +0000

Ghostwriter (UNC1151) has become one of the most closely tracked threat actors operating against Ukraine, NATO members, and Eastern European governments.

Over nearly a decade of activity, the group has combined credential harvesting, malware deployment, website compromises, cyber espionage, and coordinated influence operations targeting government institutions, military personnel, journalists, media organizations, and political actors. Public reporting has linked Ghostwriter to Belarusian military intelligence, while multiple government assessments and threat intelligence investigations have also pointed to coordination with Russian military structures and broader geopolitical objectives.

New publication. Dragonfly.

Mon, 01 Jun 2026 00:00:00 +0000

Dragonfly is one of the most well-known Russian APT groups, which for years has focused its operations on the energy sector and industrial control systems.

In this report, we examine the group’s history, tooling, known operations, and reported links to Russian state structures. Particular attention is given to campaigns targeting U.S. energy companies, including the attack on Wolf Creek Nuclear Operating Corporation.

New publication. NoName057(16).

Mon, 18 May 2026 00:00:00 +0000

NoName057(16) is a pro-russian hacktivist collective that has been conducting large-scale DDoS campaigns against government institutions, financial systems, transportation infrastructure, and media organizations across Europe and NATO-aligned countries since 2022. Unlike traditional APT groups, its activities are not focused on espionage or long-term persistence, but rather on disruption and the degradation of digital services.

New publication. APT29 (Cozy Bear).

Mon, 11 May 2026 00:00:00 +0000

APT29 (Cozy Bear) remains one of the most active cyber espionage groups linked to the Russian intelligence apparatus. Their approach is not built around “fast” attacks, but around long-term access, credential operations, and gradual persistence inside targeted infrastructure.

The report breaks down a typical APT29 attack chain — from OSINT collection, phishing delivery, and malicious RDP/HTML files to Azure AD compromise, persistence through service principals, and further activity within Office 365 and cloud environments. It also examines techniques repeatedly observed in recent campaigns, including DLL sideloading, HTML smuggling, OAuth token theft, MFA fatigue, and domain fronting.

New partnership

Mon, 20 Apr 2026 00:00:00 +0000

SHUM has established a partnership with Lex Talionis and OsintVarta as part of their joint OSINT-focused initiative.

The project brings together teams working on open-source investigations, data collection, and analytical research related to the russian federation’s defence-industrial complex and associated structures. It includes structured datasets, mapping, and analysis aimed at improving transparency and enabling further investigative work.

SHUM R&D Now Has a GitHub

Sat, 18 Apr 2026 00:00:00 +0000

Our Research and Development department has been running in the background for a while now — building tools and internal solutions that support our OSINT investigations and war crimes documentation efforts. As part of that, we’ve launched a GitHub organization. Access is restricted — our work touches sensitive areas, and we keep it that way intentionally. But if you’re a developer, researcher, or organization interested in what we’re building, feel free to reach out. We’re always open to conversation.

Volunteer Cyber Threat Intelligence

Wed, 08 Apr 2026 00:00:00 +0000

SHUM CAMP is an international analytical community focused on open-source investigations, cyber threat intelligence, and documentation of war-related activity. The team works with open data, digital evidence, and technical analysis to support situational awareness and resilience in the context of russia’s war against Ukraine.

We are looking for volunteers interested in contributing to cyber threat intelligence and OSINT analysis, particularly in tracking nation-state actors, disinformation, and cyber activity related to regional conflicts.

Recruiting survey update

Thu, 26 Mar 2026 00:00:00 +0000

We’ve updated the volunteer application form — time to apply.

We have open volunteer positions — anyone can join, regardless of experience or field. OSINT, cybersecurity, analysis, or journalism — all the details are at the link.

Together we do work that matters.

New publication. APT-Playbook.

Mon, 23 Mar 2026 00:00:00 +0000

This analytical report examines how GRU-linked APT groups operate in cyberspace as interconnected elements of a coordinated system rather than as isolated actors.

It reconstructs the operational logic behind units such as APT28 and APT44, showing how cyber operations are integrated with intelligence gathering, sabotage, and information campaigns. The analysis highlights that cyber activity is often driven by geopolitical triggers such as wars, elections, and crises, while different units perform distinct roles within a shared operational ecosystem.

OsintVarta and Lex Talionis have developed a map

Wed, 25 Feb 2026 00:00:00 +0000

6,000 defense-industrial complex enterprises of the russian federation are now available on an interactive map.

Lex Talionis and OsintVarta have developed a map of enterprises operating within the aggressor state. The platform includes descriptions of their activities and specific developments, information on vetted employees with enriched data, as well as structured categorization for easier navigation and analysis. All datasets are available for download.

SHUM CAMP is expanding its volunteer team

Tue, 24 Feb 2026 00:00:00 +0000

We are currently looking for:

OSINT / GEOINT / Technical Intelligence Analyst
Volunteer Editor
Community Manager
AI / Automation / Full-Stack Engineer

Our work focuses on open-source investigations, analytical reporting, community coordination, and building technical tools that support evidence-based research.

All roles are remote with flexible engagement.

If you are interested in applying your analytical, editorial, community, or technical skills to meaningful investigative work, we invite you to join our team.

Volunteer AI Automation / Full‑Stack Engineer

Tue, 24 Feb 2026 00:00:00 +0000

The public organization SHUM CAMP brings together specialists from the international community who work with open-source information and document crimes committed during the armed conflict unleashed by russia against Ukraine. We develop our own tools for data collection and analysis, support law enforcement authorities, and counter disinformation.

What You Will Be Doing

Develop and maintain web applications for the OSINT community (TypeScript + React);
Build a reliable backend and microservices for data processing (Python; optionally Node.js/Golang);
Design and configure databases (PostgreSQL as the primary database; MongoDB/Typesense/ClickHouse optional);
Integrate LLMs (Large Language Models) and build RAG architectures for analyzing large text corpora;
Create and orchestrate automated workflows (n8n, AI Agents);
Work with containerization (Docker, Docker Compose) and understand network architecture;
Develop cross-platform mobile applications in Flutter (Dart) for iOS and Android from a single codebase, managing app state with a focus on an offline-first architecture;
Contribute to designing the architecture of systems for data collection and analysis.

Who We Are Looking For

We are looking for an independent specialist who is ready to take ownership of technical decisions.

Volunteer Community Manager

Tue, 24 Feb 2026 00:00:00 +0000

The public organization SHUM CAMP brings together specialists from the international community who work on analytical, research, and volunteer projects under conditions of high informational and psychological strain. As part of our work, we place special emphasis on psychological safety, the quality of internal processes, and support for volunteers and related teams.

Volunteer Editor

Tue, 24 Feb 2026 00:00:00 +0000

The public organization SHUM CAMP brings together specialists from the international OSINT community. We investigate crimes committed during the armed conflict launched by russia against Ukraine, provide consultations to law enforcement and judicial authorities, counter disinformation, and implement projects aimed at protecting human rights.

What You Will Be Doing

Editing analytical texts, reports, briefs, and explanatory materials;
Bringing materials into a unified style and structure;
Working with document templates (reports, analytical notes, internal materials);
Creating and improving editorial templates for different types of content;
Reviewing the logic of presentation, clarity of wording, and structural accuracy of texts;
Preparing official letters, requests, and supporting communication with external partners and organizations.

Who We Are Looking For

Individuals with a confident command of Ukrainian and English;
Those who are able to work with analytical and technical texts;
People attentive to detail and structure;
Candidates with experience or a strong interest in editing reports, research papers, and analytical materials;
Skills in working with text editors (Google Docs, Word, etc.); experience with Figma will be an advantage.

What We Offer

Remote work — work from anywhere that is convenient for you;
Part-time involvement that can be combined with other responsibilities;
A flexible schedule;
Work with real analytical materials and projects;
Participation in an international community of professionals and valuable experience in the field of OSINT and analytics.

We work with volunteers from all over Ukraine and worldwide.

Volunteer OSINT / GEOINT Analyst

Tue, 24 Feb 2026 00:00:00 +0000

The public organization SHUM CAMP brings together specialists from the international community who work on analytical and research projects in the fields of open data, documentation of war crimes, and countering disinformation. We cooperate with law enforcement and judicial authorities, as well as international partners, providing evidence-based analysis in the context of the armed conflict launched by russia against Ukraine.

New publication. APT28 Fancy Bear.

Mon, 23 Feb 2026 00:00:00 +0000

A closer look at the hacker group APT28, also known as Fancy Bear.

APT28 does not operate randomly. Its target selection is systematic and politically driven, aligning with russia’s active geopolitical interests.

During the 2016 U.S. presidential election, the breach of email accounts and servers belonging to U.S. political organizations became more than a hacking incident — it became an instrument of geopolitical influence. Entities such as the Democratic National Committee were compromised, and stolen materials were later weaponized in the information domain.

New publication. APT 44 Sandworm.

Sun, 22 Feb 2026 00:00:00 +0000

In 2017, the NotPetya cyberattack caused more than $10 billion in global economic damage, disrupting ports, manufacturing operations, and logistics networks worldwide.

According to official statements from the U.S. and U.K. governments, the attack was attributed to units of russia’s military intelligence agency (GRU) — specifically the group known as Sandworm (also referred to as APT44).

OSINT Copilot platform now available for SHUM partners and personnel

Wed, 11 Feb 2026 00:00:00 +0000

OSINT Copilot is an intelligence automated solution to quickly collect and organize open-source information in one place. Instantly structured data instead of spending time manually assembling information.

The Service utilizes AI and LLMs to generate reports, summaries, and risk assessments.

OSINT Copilot can help you:

• Collect information from multiple open sources

Good news for Matrix users

Mon, 02 Feb 2026 00:00:00 +0000

Good news for Matrix users: we’ve launched an open news channel!

We’ll be sharing updates, analytical notes, and announcements — directly on Matrix.

Join here

Aggregator Update: One Source Added

Mon, 26 Jan 2026 00:00:00 +0000

The Aggregator tool has been updated with one new data source: LeakCheck. LeakCheck is a breach-search service that helps identify exposed credentials and related leak artifacts by searching across large leak datasets (e.g., email/username and other supported query types), with options for API-based integration, monitoring, and bulk checks.

Donation page update

Mon, 12 Jan 2026 00:00:00 +0000

We’ve refreshed our Donation Hub to make supporting SHUM OSINT simpler and faster. The page is now a single place where you can choose the method that fits you best and complete a donation in a couple of clicks.

What’s new:

Monobank jar / card payment — quick top-ups with an option to pay by card.
Crypto donations — via Plisio, helping us fund the tools and infrastructure that keep our work running.
A clearer “Join the team” call-to-action if you want to contribute with skills, not only money.

If SHUM’s work matters to you — drop by the Donation Hub, pick your preferred method, and support our operations. Every contribution helps us stay effective and resilient.

Presentation of the book about Olenivka

Sat, 13 Sep 2025 00:00:00 +0000

Next Wednesday, September 17, at 7:00 PM, MIPL, along with partners from Memorial and The Ukrainian Media, will present a book about the explosion in the Olenivka colony. The event will take place at the Sense bookstore on Khreshchatyk.

We invite you to join us; all the details can be found on the event page. We will also be extremely grateful if you support us by sharing

Join the AI + OSINT Research Community on Discord

Mon, 01 Sep 2025 00:00:00 +0000

We are building a collaborative space for researchers, investigators, and practitioners who explore the intersection of artificial intelligence and open-source intelligence (OSINT). Inside the community, you’ll find:

Discussions on AI-driven OSINT workflows

Knowledge sharing and practical case studies

Networking with like-minded professionals

Opportunities to co-create research and tools

The invite link is active for 7 days only. After that, you can request a new one from the project curators. https://discord.gg/n4EYAg23

Handbook on countering disinformation

Tue, 26 Aug 2025 00:00:00 +0000

In the digital age, the traditional boundaries between peace and war are fading. Today, battles are fought not only on physical battlefields but also in the virtual space, where disinformation has become a powerful weapon of mass destruction. Every day, millions of people encounter manipulation, fake news, and propaganda campaigns — often without even realizing it.

Handbook “Weapons of Information Warfare”

Mon, 25 Aug 2025 00:00:00 +0000

In today’s world, disinformation has become one of the most dangerous tools for undermining democratic values and social stability. Fake news, manipulative content, and coordinated influence campaigns threaten the foundations of an informed society, erode trust in institutions, and create polarization in public opinion.

The Center for Countering Disinformation at the National Security and Defense Council of Ukraine, with the support of the European Union Advisory Mission in Ukraine, has presented a fundamental handbook on countering disinformation. This document summarizes the best international practices in combating information threats and adapts them to the Ukrainian context.

Strong Support = Effective Frontline

Mon, 11 Aug 2025 00:00:00 +0000

We are raising funds to purchase a vehicle for our friend, a service member who has been defending Ukraine since the first days of the full-scale invasion. Currently, while carrying out missions in the Kharkiv sector, he and his team require a vehicle for logistics and other essential needs that regularly arise in the combat zone.

Recruitment campaign August-October

Sun, 10 Aug 2025 00:00:00 +0000

Our community, which unites OSINT specialists and volunteers, invites new partners! We are open to cooperation with other public organizations, as well as to attracting volunteers - people who share our values and are ready to join the common cause.

How to join:

Apply on the website https://recruiting.shum-ng.org/ and fill out the questionnaire using the form. Tell us about yourself and your motivation. This helps us understand your skills, interests and experience.
Interview and screening, we will communicate in a call format to understand in which direction you can join.
Verification, we check candidates for recommendations.
Receive an educational or test task.

We value competence, responsibility and motivation. If you are ready to work systematically with us, leave an application and we will contact you!

Summary Presentation on the Procedure in Case a Person Goes Missing

Sat, 09 Aug 2025 00:00:00 +0000

To make it easier to navigate the available official information on the procedures in case a person goes missing under special circumstances, we have prepared a brief presentation based on materials from the Coordination Headquarters, the Ministry of Internal Affairs, and the Office of the Ombudsman. It summarizes essential information on how to act in cases of captivity or disappearance, how to seek assistance, which institutions to contact, and what to keep in mind in the initial stages.

Roadmap for Families and Individuals Released from Captivity

Fri, 08 Aug 2025 00:00:00 +0000

We are sharing an official document developed by the Coordination Headquarters for the Treatment of Prisoners of War. This roadmap contains guidance for family members of service personnel who are currently in captivity, as well as for individuals who have already returned. It includes: stages of interaction with state authorities; procedures for applying for assistance; access to medical, psychological, and legal support; key contact information.

Steps to Take if a Person Goes Missing Under Special Circumstances and Key Contacts

Thu, 07 Aug 2025 00:00:00 +0000

In the event of a person going missing under special circumstances, it is important to act promptly and in accordance with officially approved procedures. We are sharing two official resources that may assist families in such situations. The step-by-step guidance, prepared by the Ministry of Internal Affairs of Ukraine, outlines the necessary actions, filing procedures, and contact information for relevant state authorities. We also recommend reviewing the memo developed by the Office of the Ukrainian Parliament Commissioner for Human Rights, which provides general information for families of prisoners of war, missing persons, and unlawfully detained civilians.

Aggregator Update: Two Sources Added

Mon, 23 Jun 2025 00:00:00 +0000

The Aggregator tool has been updated with two new data sources. OpenSanctionsDB is a database that consolidates information on sanctions lists, politically exposed persons (PEPs), and entities involved in corruption schemes, financial crimes, and sanctions evasion. Integrating OpenSanctions provides the system with more comprehensive and structured datasets compiled from official sources worldwide. In turn, this enables more effective detection of links between individuals and organizations during investigations. The second integrated source remains undisclosed.

Empowering Our AI Workflow with a Custom CVAT.ai Instance

Wed, 11 Jun 2025 00:00:00 +0000

The launch of our private, custom-deployed instance of CVAT.ai — a powerful, open-source annotation tool designed for computer vision teams. This marks a significant step in streamlining our data labeling workflows for machine learning and AI model development.

Secure and Role-Restricted. Built with security at the forefront, our deployment restricts access to only authorized project personnel. Whether you’re an annotator, reviewer, or admin, the system is tailored to your role and responsibilities.
Project-Focused Precision. Each annotation task is linked to a clearly defined project structure, allowing for organized collaboration, consistent labeling schemas, and targeted performance metrics.
Custom Tooling for High-Quality Results. From polygons to segmentation masks, our instance supports all critical annotation types. We’ve also integrated project-specific labeling schemas to align with our training data requirements.
Productivity Meets Oversight. Annotator activity is tracked in real-time, and all annotations are versioned and auditable. This means better oversight, fewer errors, and higher-quality data to feed into our ML pipelines.
Built for Scale and Integration. With full API access and webhook support, our CVAT instance connects smoothly with the rest of our AI infrastructure, ensuring annotation tasks can be automated and scaled as needed.

This launch reflects our continued investment in secure, scalable, and smart infrastructure to support advanced AI development. By combining CVAT’s flexibility with our team’s expertise, we’re pushing the boundaries of what’s possible in machine learning workflows.

Join the SHUM Community

Tue, 10 Jun 2025 00:00:00 +0000

Our community, which brings together OSINT professionals and volunteers, is open to new partners! We welcome collaboration with civil society organizations as well as individuals who share our values and are ready to contribute to our common mission.

How to get involved:

Application — briefly tell us about yourself and your motivation
Questionnaire — helps us understand your skills, interests, and experience
Interview and screening — a conversation to determine how you can contribute
Reference check — we verify applicants through recommendations
Training or test assignment — depending on the area of engagement

We value competence, responsibility, and motivation. If you’re ready to work with us in a structured and professional way — submit your application, and we will get in touch.

Leak Aggregator: A Tool for Efficient OSINT Analysis

Fri, 06 Jun 2025 00:00:00 +0000

The SHUM team is working on building infrastructure to support OSINT research, and one of the internal solutions is a leak aggregator. This is a web-based tool that allows users to query data from leak databases and perform comparative analysis across different sources.

The practical value of this tool lies in providing analysts with a reliable way to verify information from various leaks while staying within operational budget constraints. It helps centralize access to data and enables fast cross-checking without the need for multiple individual subscriptions or time-consuming manual comparisons.

About us

Thu, 05 Jun 2025 00:00:00 +0000

A team of specialists from the international OSINT community is launching the SHUM project. SHUM is a public organization whose goal is to use OSINT (Open Source Intelligence) technologies to investigate crimes in the armed conflict initiated by Russia against Ukraine, as well as to consult law enforcement and judicial authorities, combat disinformation, and participate in projects aimed at protecting human rights. A team of specialists from the international OSINT community is launching the SHUM project. SHUM is a public organization whose goal is to use OSINT (Open Source Intelligence) technologies to investigate crimes in the armed conflict initiated by Russia against Ukraine, as well as to consult law enforcement and judicial authorities, combat disinformation, and participate in projects aimed at protecting human rights.

Donations

Tue, 08 Apr 2025 00:00:00 +0000

Donations

SHUM is an independent and non-profit organization that impartially investigates facts of probable international crimes committed during the armed conflict, thanks to an open funding model. To support our team’s activities, we need financial assistance.

Current Needs

IBAN UA 54 322001 0000 0262 0335 85641 64

Fundraising for a vehicle for the Armed Forces of Ukraine in the Kharkiv direction for logistics and other related tasks that constantly arise on the front line.

reports are updated on social media
donation and support bank details are always up to date

Support the unit to ensure the successful completion of combat missions.

Short Summary

Tue, 19 Mar 2024 00:00:00 +0000

About Us

SHUM is a public organization created by experts from the international OSINT community. We use OSINT (Open Source Intelligence) technologies to investigate crimes in the armed conflict initiated by russia against Ukraine, as well as to provide consultations to law enforcement and judicial authorities, combat disinformation, and participate in projects aimed at protecting human rights.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

Contact Us

Tools

Mon, 01 Jan 0001 00:00:00 +0000

Our instruments, some access might be restricted for SHUM personnel only.

Aggregator - A web-based tool that extracts data from sources on request and enables comparative analysis between them. This solves the issue of budgeting for such requests and provides operators with the ability to cross-verify data from different sources.