Cyber Threat Actor: Penis

The threat actor known by the alias Penis is located in the United States of America and came to public attention in February 2016 after publishing the personal information of more than 9,000 Department of Homeland Security employees. The actor claimed to have compromised a single Department of Justice email account through social engineering, telephoning a help desk and pretending to be a new employee who did not understand how to bypass the security portal; after being told that a token code was not required, the actor used the provided credentials to log into the DOJ intranet and download approximately 200 gigabytes of a government worker database. From this data the actor extracted names, job titles, email addresses and phone numbers of DHS staff, including program analysts, information security professionals, IT personnel, directors and approximately 100 individuals with intelligence‑related titles, and threatened to release similar details for about 20,000 FBI officials. The leaked information was verified by calling random numbers from the list and confirming that they reached the voicemail of the listed employees, and the actor’s Twitter account @DotGov posted the data along with a pro‑Palestinian message referencing Gaza and West Bank concerns. No malware families or custom tooling are described in the reporting; the intrusion relied entirely on social engineering to obtain legitimate access credentials and then used standard intranet navigation to exfiltrate the data.

The actor’s targeting is confined to U.S. government entities, specifically the Department of Homeland Security, the Federal Bureau of Investigation and the Department of Justice, focusing on employees in intelligence, information technology and security roles. The sources do not explicitly state the actor’s strategic objectives in terms of financial gain, espionage or disruption, so those aspects are not included here. Public attribution does not link the actor to any state sponsor or criminal consortium; the only publicly available identifiers are the alias Penis and the United States location. The February 2016 leak of DHS employee data, accompanied by the threat to release FBI personnel information, represents the actor’s sole publicly reported campaign and serves as the representative example of their activity. No further operations or additional tooling have been documented in the available material.