Ghost Squad Hackers ("GSH") is a hacktivist group responsible for several cyber attacks. Former targets of the group include central banks, Fox News, CNN, the United States Armed Forces and the government of Israel. The group is led by a de facto leader known as s1ege (leet for "siege"), and selects targets primarily for political reasons. The group forms a part of the hacktivist group Anonymous. [1] [2]
In January 2016, GSH defaced Ethiopian government websites in response to the killing of nearly 500 students and activists by Ethiopian Security Forces during protests that became extremely violent was involved in the latter part of 2015 and then sparked again between August and October in 2016 Ethiopian protests. [3] [4] [5]
On May 21, 2016 GSH targeted Donald Trump's official website by launching Distributed Denial of Service (DDoS) attacks for what they saw as racist comments made towards refugees and Mexicans. [6] [7] Shortly after targeting Trump's official website GSH shut down Trump's hotel collection websites. [8] [9] [10]
The group gained more notoriety after having successfully leaked data of the Israeli Defense Force on April 7, 2016. This was the day #OpIsrael was launched along with Anonymous, leaking the Database of Israel Defense Force posting thousands of IDF soldiers, border patrol, and Israeli Air Force personnel information online. [11] [ unreliable source ]
On April 23, 2016 GSH targeted the Loyal White Knights of the Ku Klux Klan by taking their websites down in the protest of racism while Anonymous vs. KKK protests were happening in the state of Georgia, U.S.A. [12] [13] [14] [15] [16] [17] [18] [19]
In 2016, GSH took down the official website of Black Lives Matter, claiming the organization fueled further racism. [20] [21] [22] [23]
GSH and Anonymous worked in correlation together when "Operation Icarus" was first launched in February 2016. [24] The op was aimed at attacking the central banking system which the attackers accused the banks with corruption and wanted to raise public awareness. This attack sparked the invitation of more hacking teams and affiliations of Anonymous to focus their attention towards that of the Central Banks in direct regards of further scrutiny and cyber attacks. [25]
Ghost Squad Hacker's leader s1ege claimed responsibility for the attacks which were carried out on the Bank of England email server and dozens of other banking websites including the New York Stock Exchange, Bank of France, Bank of Greece, Bank of Jordan and the Bank of South Korea, among others. s1ege went on to state that they want to "start an online revolution" to retaliate against the "elite banking cartels putting the world in a perpetual state of chaos." [26] [27] [28] Hundreds of banks were targeted in this operation and to this day the exact number of banks affected is unknown. [29] [30] [31] [32] [33] [34] [35]
Notoriety of the group continued to escalate as the heat was turned up during the month of June, 2016. After censoring of media coverage in regards to OpIsrael, OpSilence [36] was initiated targeting mainstream media outlets such as CNN and Fox News. [37] [38] [39] [40] [41]
A data dump was later leaked after hacking the United States Military personnel files and releasing information on close to 2,437 army personnel. [42] [43] The information contained in the link was uploaded to an onion link on the dark web along with a paste-bin link which contained credit card numbers and personal information on U.S. Army personnel. [44] [45] [46] [47] [48] [49] [50]
July 19, 2016 the sub domain of Baton Rouge City government website [51] was hacked twice in one day by GSH after previously making news after attack towards both the KKK and BLM. [52] These attacks however were targeting the City of Baton Rouge, Louisiana in protest against police brutality in which a city native Alton Sterling was shot and killed by Baton Rouge police officers on the 5th earlier that month. The Baton Rouge website [53] was defaced along with a picture of Alton Sterling with a message that read, "Being black is not a crime! This is for the shooting of Alton Sterling, just because he's black does not mean he is a bad guy. You will pay. We are the justice. We are Ghost Squad Hackers. /R.I.P. Alton Sterling". [54]
On July 31, 2016 GSH took over the official Twitter account of Afghanistan's Chief Executive Dr. Abdullah Abdullah in an effort to raise awareness against corruption and alleged drug deals between Afghanistan and the U.S. They also targeted the Afghan Public Credit Registry website [55] by defacing it which also further allowed them access to several social media accounts including Dr. Abdullah's in which they tweeted,
"Afghanistan Gov Hacked by GhostSquadHackers #CheifExecutiveOfficer Can you hear me now? twitter.com/afgexecutive. We found an exploit in the government server and pulled every login we could. We have more also but Dr. Abdullah was not using phone restriction and 2FA was not enabled". [56]
The attacks on the Afghan government continued relentlessly on the first of September after prior targeting of Afghanistan's Chief Executive Twitter account, GSH further assaulted the government by defacing twelve websites in one day all of which were affiliated with the Afghan government. [57] This included Afghanistan's Ministry of Justice, the Ministry of Defense, the Ministry of Foreign Affairs, the Ministry of Refugees and Repatriations, and the Afghan Attorney General's Office. Further assaults continued in hopes of raising awareness for Palestine as part of OpSilence [58] and OpIsrael after shutting down the Israeli Prime Minister and the Bank of Israel. [59]
The group's focus in 2017 shifted slightly towards targeting ISIS and removing them off the internet and social media completely. A multitude of accounts from Facebook, Twitter, and Telegram alike were hacked and added to an extensive list of ISIS removed. Further efforts by GSH later revealed bomb instructions and plans to be carried out by ISIS. [60] [61]
s1ege stated "We really do not care about attacking the U.S. elections. They've already been hacked. We mostly hack ISIS" in an interview with CBS news in the year 2018. [62] [63]
On February 12, 2019 s1ege released a massive leak on Islamic State Telegram and WhatsApp group's/channel's administrators. The leak included hacked phones/mobile devices, hacked Telegram accounts, hacked Facebook's, hacked Twitter accounts, credit cards, geolocation data, government issued ID cards, and IP logs belonging to the administrators. The group successfully infiltrated the Islamic state community on encrypted communication applications and exposed the administrators by using malware and exploits. [64] [65] [66] [67] The leak was published on mega.nz and Ghost Squad Hackers Official Twitter account. [68] [69] [70] [71] One of the Telegram and WhatsApp Admins (Riffat Mahmood Khan) was a former taxi driver living in Auburn was linked to ISIS and accused of administering the group's encrypted messages. He traveled to Syria in support of the Islamic State in 2015. He returned from the conflict zone via Turkey six months later, and was promptly picked up by Australian Federal Police officers at the airport as he flew in, in September 2015. Video footage from the raids obtained by The Herald showed his wife and the children being led away from the home by uniformed police, while officers swarm on the Auburn home. He is believed to not have actually participated in the fighting in Syria, but spent time there with the radical group before returning and allegedly continuing his work for the Caliphate. The man remained involved with the Islamic State's encrypted online messaging and continued to take care of the WhatsApp and Telegram groups that the radical Islamic group uses to communicate internally and for recruiting. Documents leaked by GSH showed that several of the accused ISIS supporter's children were enrolled in local Islamic school Al Bayan. He attended South Granville mosque Al Noor, where some sources suggest he became radicalized. Images from his hacked phone exposed by GSH depicted the ISIS flag flying above Venice, explosions, blood-stained knives, children brandishing ISIS flags, a meme saying 'One bullet away from Paradise' and critically wounded soldiers. [72] [73] [74] [75] Leaked data from GSH showed one Belgian (Siraj El Moussaoui), known to be an ISIS supporter, had a video on his phone about how to most effectively behead someone. Siraj El Moussaoui tried in vain to join the Islamic State in 2016 and was arrested shortly after on suspicion of plotting an attack in Belgium. [76] [77]
Starting in April 2020 GSH conducted in a large number of mass defacements of government websites as well as root ownership of an Indian Government server and leaked data from the Australian government. This also included governments such as Australia, India and various others. The Twitter feed of GSH has shared a multitude of alleged attacks on various government websites during the pandemic using hashtags associated with previous campaigns of #FreeJulianAssange. [78] [79] [80] [81]
In June the group claimed responsibility for the hacking of other Indian government websites in protest against the internet ban in Jammu and Kashmir.
GSH gave warning in a LiveWire interview saying “To the people of Jammu and Kashmir, we will support your efforts and continue to back you through this pandemic and tyrannical government's grip. If India's government is persistent, we will be more persistent and consistent. No region/state/ethnic group should not have access to the internet, not even limited access. These are basic civil rights and liberties.” [82] [83] [84] [85]
The group defaced the European Space Agency (ESA) website https://business.esa.int in July 2020. GSH claimed the attack was just for fun. They explained that they exploited a server-side request forgery (SSRF) remote code execution vulnerability in the server, then they gained access to the business.esa.int server and defaced it. Having no interest in leaking any data their intent was solely to show the server was vulnerable. Within a week of hacking the business domain of the ESA they defaced the https://space4rail.esa.int website as well. [86] [87] [88] [89] [90]
On July 27, 2020 GSH successfully targeted Idaho state websites servers locking agencies out of their own servers. Idaho Government websites targeted included the Idaho supreme court, Idaho court, Idaho Parks and Recreation, Idaho STEM Action Center, and were victims to the group. The sites were used to broadcast messages referencing Julian Assange, founder of WikiLeaks, who was charged with violating the Espionage Act. The messages read “Free Julian Assange! Journalism is not a crime.” [91] [92] [93] [94] [95] [96]
September 3, 2020 - GSH claimed responsibility for the breach of the Vermont Sheriff's Association, which resulted in a data leak of names, addresses, financial data and communications between/to various Vermont sheriffs. The leaked data was published in retaliation to the shootings of various individuals who fell victim to police brutality; including George Floyd, Jacob Blake, and Breonna Taylor. [97] [98] [99]
Hacktivism, is the use of computer-based techniques such as hacking as a form of civil disobedience to promote a political agenda or social change. A form of Internet activism with roots in hacker culture and hacker ethics, its ends are often related to free speech, human rights, or freedom of information movements.
The Internet has a long history of turbulent relations, major maliciously designed disruptions, and other conflicts. This is a list of known and documented Internet, Usenet, virtual community and World Wide Web related conflicts, and of conflicts that touch on both offline and online worlds with possibly wider reaching implications.
Anonymous is a decentralized international activist and hacktivist collective and movement primarily known for its various cyberattacks against several governments, government institutions and government agencies, corporations and the Church of Scientology.
Operation Payback was a coordinated, decentralized group of attacks on high-profile opponents of Internet piracy by Internet activists using the "Anonymous" moniker. Operation Payback started as retaliation to distributed denial of service (DDoS) attacks on torrent sites; piracy proponents then decided to launch DDoS attacks on piracy opponents. The initial reaction snowballed into a wave of attacks on major pro-copyright and anti-piracy organizations, law firms, and individuals. The Motion Picture Association of America, the Pirate Party UK and United States Pirate Party criticised the attacks.
The Jester is a self-identified grey hat hacktivist. He claims to be responsible for attacks on WikiLeaks and Islamist websites. He claims to be acting out of American patriotism.
Teamp0ison was a computer security research group consisting of 3 to 5 core members. The group gained notoriety in 2011/2012 for its blackhat hacking activities, which included attacks on the United Nations, NASA, NATO, Facebook, Minecraft Pocket Edition Forums, and several other large corporations and government entities. TeaMp0isoN disbanded in 2012 following the arrests of some of its core members, "TriCk", and "MLT".
Jigsaw LLC is a technology incubator created by Google. It formerly operated as an independent subsidiary of Alphabet Inc., but came under Google management in February 2020. Based in New York City, Jigsaw is dedicated to understanding global challenges and applying technological solutions. From "countering extremism", online censorship, and cyber-attacks to protecting access to information. The current CEO is Yasmin Green.
Anonymous is a decentralised virtual community. They are commonly referred to as an internet-based collective of hacktivists whose goals, like its organization, are decentralized. Anonymous seeks mass awareness and revolution against what the organization perceives as corrupt entities, while attempting to maintain anonymity. Anonymous has had a hacktivist impact. This is a timeline of activities reported to be carried out by the group.
OpIsrael (#OpIsrael) is an annual coordinated cyber-attack where hacktivists attack Israeli government and even private websites with DDoS attacks and more. The inaugural campaign was launched in 2013 by Anonymous hackers on the eve of Holocaust Remembrance Day. The campaign has since been held annually.
Israeli Elite Force (iEF) is a hacktivism group founded two days before OpIsrael on April 5, 2013, that is responsible for multiple high-profile computer attacks and large scale online vandalism. Targets include ISPs, domain registrars, commercial websites, educational institutions, and government agencies. The group's core members are: mitziyahu, Buddhax, amenefus, bl4z3, r3str1ct3d, Mute, Cyb3rS74r, Oshrio, Aph3x, xxtr, Kavim, md5c, prefix, Cpt|Sparrow, gal-, gr1sha, nyxman and TheGodOfHell.
Lizard Squad was a black hat hacking group, mainly known for their claims of distributed denial-of-service (DDoS) attacks primarily to disrupt gaming-related services.
Ghost Security, also known as GhostSec, is a self-described "vigilante" group that was formed to attack ISIS websites that promote Islamic extremism. It is considered an offshoot of the Anonymous hacking collective. According to experts of online jihad activism, the group gained momentum after the Charlie Hebdo shooting in Paris in January 2015. The group claims to have taken down hundreds of ISIS-affiliated websites or social media accounts and thwarted potential terrorist attacks by cooperating with law enforcement and intelligence agencies. The group uses social media hashtags like #GhostSec - #GhostSecurity or #OpISIS to promote its activities.
The Islamic State Hacking Division (ISHD) or The United Cyber Caliphate(UCC) is a merger of several hacker groups self-identifying as the digital army for the Islamic State of Iraq and Levant (ISIS/ISIL). The unified organization comprises at least four distinct groups, including the Ghost Caliphate Section, Sons Caliphate Army (SCA), Caliphate Cyber Army (CCA), and the Kalashnikov E-Security Team. Other groups potentially involved with the United Cyber Caliphate are the Pro-ISIS Media group Rabitat Al-Ansar (League of Supporters) and the Islamic Cyber Army (ICA). Evidence does not support the direct involvement of the Islamic State leadership. It suggests external and independent coordination of Pro-ISIS cyber campaigns under the United Cyber Caliphate(UCC) name. Investigations also display alleged links to Russian Intelligence group, APT28, using the name as a guise to wage war against western nations.
Hack Forums is an Internet forum dedicated to discussions related to hacker culture and computer security. The website ranks as the number one website in the "Hacking" category in terms of web-traffic by the analysis company Alexa Internet. The website has been widely reported as facilitating online criminal activity, such as the case of Zachary Shames, who was arrested for selling keylogging software on Hack Forums in 2013 which was used to steal personal information.
BlueLeaks, sometimes referred to by the Twitter hashtag #BlueLeaks, refers to 269.21 gibibytes of internal U.S. law enforcement data obtained by the hacker collective Anonymous and released on June 19, 2020, by the activist group Distributed Denial of Secrets, which called it the "largest published hack of American law enforcement agencies".
Distributed Denial of Secrets, abbreviated DDoSecrets, is a nonprofit whistleblower site founded in 2018 for news leaks. The site is a frequent source for other news outlets and has worked on investigations including Cyprus Confidential with other media organizations. In December 2023, the organization said it had published over 100 million files from 59 countries.
Cyberwarfare is a component of the confrontation between Russia and Ukraine since the Revolution of Dignity in 2013-2014. While the first attacks on information systems of private enterprises and state institutions of Ukraine were recorded during mass protests in 2013, Russian cyberweapon Uroburos had been around since 2005. Russian cyberwarfare continued with the 2015 Ukraine power grid hack at Christmas 2015 and again in 2016, paralysis of the State Treasury of Ukraine in December 2016, a Mass hacker supply-chain attack in June 2017 and attacks on Ukrainian government websites in January 2022.
Anonymous, a decentralized international activist and hacktivist collective, has conducted numerous cyber-operations against Russia since February 2022 when the Russian invasion of Ukraine began.
{{cite web}}
: CS1 maint: numeric names: authors list (link){{cite web}}
: CS1 maint: numeric names: authors list (link){{cite web}}
: Missing or empty |title=
(help)