Joker DPR and the Information War

Recorded Future’s Insikt Group examines the pro-Russian hacktivist threat group “Joker DPR”, which has become more prominent during Russia’s ongoing invasion of Ukraine. The group is well-known for its alleged cyber activities, which have targeted and publicized sensitive information on Ukrainian military and government web resources, and for its social media presence, which it has exploited to disseminate pro-Russian, anti-Ukrainian propaganda.

To date, Joker DPR’s most significant claim has been an alleged breach of DELTA, a battlefield management system (BMS) that has proven effective for Ukraine’s national defense. Joker DPR’s alleged breach was unlikely to have been as wide-reaching as the threat group claimed. Nevertheless, it is part of a growing body of evidence that suggests Joker DPR is deliberately supporting Russia’s information war in Ukraine.

Joker DPR is notorious for spreading pro-Russian, anti-Ukrainian propaganda. Here the threat group mocks the death of a pro-Ukrainian fighter in the Donbass.

Based on the alignment of Joker DPR’s activities with the goals of Russian influence operations in Ukraine — specifically, undermining support for the Armed Forces of Ukraine (AFU) and Ukrainian government — it is likely that Joker DPR’s activities are directed at amplifying Russian information operations in Ukraine, possibly with the coordination of the Russian state.

Joker DPR has cultivated a sophisticated persona. Although characterized as an individual in its communications, it is likely that Joker DPR is a threat group that is reliant upon a coordinated human infrastructure of Ukrainians who sympathize with Russia and like-minded threat actors to gather the sensitive information that the group publishes.

Joker DPR has built a sizable following on its Telegram channel. As its audience and infrastructure grows, it may gain the increased ability to undermine Ukraine’s war effort. Although Ukrainian authorities have not yet targeted Joker DPR, recent events suggest that they will make efforts to identify, arrest, and prosecute members of Joker DPR’s network when they have the resources and opportunities to do so, or as the influence and threat level of Joker DPR grows. Although Joker DPR’s alleged penetration of DELTA was unlikely to be as wide-reaching as the group claimed, similar activity may lead to the increased international scrutiny of pro-Russian hacktivist threat groups.

To read the entire analysis with endnotes, click here to download the report as a PDF.