Cyber Threat Actor: BigBrother’s Gaze

Thethreat actor known as BigBrother’s Gaze has been linked to a single publicly reported intrusion. The alias appears in connection with a hack of a prison surveillance system in southern Thailand. According to Thai authorities, the breach occurred on December 24, 2019, at Lang Suan Prison in Chumphon province. The actor gained unauthorized access to the prison’s camera network and streamed live footage from multiple security cameras. The stream was broadcast on a YouTube channel bearing the name BigBrother’s Gaze for several hours. The video showed inmates’ activities and was later removed from the platform after the incident was discovered. A Corrections Department official confirmed that the compromise originated from outside Thailand. The official noted that the hacker was an unknown external party exploiting the prison’s Internet of Things devices. The incident prompted the prison to shut down its camera system, launch an internal investigation, and file a police complaint. Open‑source reporting places the actor’s geographic origin in China, although no further detail on sponsorship or affiliation is provided.

The only observable tactic in this case involved exploiting weakly secured Internet of Things surveillance cameras to achieve initial access. No specific malware families, exploit kits, or custom tools were mentioned in the public reports. The actor’s activity appears limited to hijacking video feeds and rebroadcasting them on a public platform. Attribution to a state‑sponsored group or criminal consortium is not established in the source material. The location indicator of China is the only geographic clue available, but it does not confirm any governmental backing. No additional campaigns, tools, or infrastructure have been publicly attributed to BigBrother’s Gaze beyond this incident. Consequently, the actor’s profile remains defined by a single IoT‑based hijacking event with limited technical detail. Any further characterization would require additional verified reporting that is not present in the current source set.