DotGov
Attribution profile
- Type
- Activist
- Location
- United States of America
- Known incidents
- 2 incidents
- Sources
- 2 sources
- First seen
- 2016-02-06
- Last seen
- 2016-02-07
- Updated
- 2026-10-13 09:33
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
DotGov is an alias used by a threat actor known to operate from the United States. The actor has targeted U.S. federal government entities, specifically the Federal Bureau of Investigation, the Department of Homeland Security, and the Department of Justice, seeking to expose employee personal information such as names, titles, email addresses and phone numbers. Initial access was achieved through social engineering, wherein the actor posed as a new employee to obtain credentials for a Department of Justice email account, which was then used to log into the DOJ intranet and exfiltrate approximately 200 GB of government worker data. The actor communicated via the Twitter handle @DotGov, posting the leaked data and later deleting the messages, and included pro‑Palestinian political references to Gaza and West Bank concerns as well as remarks about Israel‑Palestine tensions. No malware families or specific tooling suites are described in the available sources, and no public attribution to a state sponsor or criminal consortium has been made. The most notable activity attributed to DotGov is the February 2016 disclosure of over 9,000 DHS employee records and the accompanying threat to release data on roughly 20,000 FBI officials.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 2 sources.