❗️CYBERATTACK ON KHIMVOLOKNO
- Feb 26
- 2 min read
We struck the computer network of Khimvolokno, the largest supplier of nylon yarn in Russia — the material used to make the lining for helmets and body armor for the Russian army. 👊💥
Cyberattack on Khimvolokno — Details
We targeted Khimvolokno as part of our campaign against the Lukashenko regime. The plant routinely circumvents EU sanctions and supplies technical polyamide yarn to Russia, where manufacturers use it to produce military-grade fabrics, including body armor and combat helmets.
Several former employees of Khimvolokno and its parent company, Grodno Azot, are currently political prisoners under the Lukashenko regime.
We launched the operation on February 24, the anniversary of Russia’s full-scale invasion of Ukraine. The cyberoperation lasted about 24 hours. During that time, we moved freely through the company’s network and gained full domain administrator privileges.
On the night of February 25–26, we breached the most secure segment of the IT infrastructure — the data center. We destroyed all eight physical servers, along with dozens of critical virtual machines running on them.
We disabled domain controllers, servers, virtual machines, and workstations. Some devices now carry “cyber time bombs.” In total, we gained access to roughly 1,000 machines, including servers involved in core production processes.
Khimvolokno’s employees can now prepare for forced leave. Office operations, accounting, marketing and sales, shipping, as well as technical and administrative processes have all been disrupted.
We took down ERP systems and databases, corporate email, the Directum document management system, backup systems, and more. Recovery will take weeks, and some data is gone for good.
We also compromised the security and video surveillance systems, which allowed us to monitor Khimvolokno’s operations in real time. We watched employees pull servers out and attempt to “resuscitate” them.
We are publishing excerpts from the facility’s security cameras, including footage from production areas, offices, corridors, and entry checkpoints.
Surveillance footage shows that Khimvolokno’s warehouses are severely overstocked — typically a sign of serious sales problems.
The Lukashenko regime has halted the release of political prisoners and continues to support Putin’s war. If it wants to avoid further cyber sanctions, it must resume releasing hostages and stop aiding the Russian war machine.
