Cyber Threat Actor: v0g3lSec
| Actor Type | Location | Known Incidents |
Activist
|
United States of America
|
1 incident |
|---|
Profile
The threat actor known by the alias v0g3lSec is a hacktivist group that has been linked to the Anonymous collective. The group’s location is reported as the United States of America. It operates under a pseudonym used on Twitter to claim responsibility for its activities.
v0g3lSec’s observed targeting focuses on Russian institutions, specifically the space research sector. In March 2022 the group breached a subdomain of the Russian Space Research Institute (IKI) which hosts the World Space Observatory Ultraviolet project. The defacement of the site referenced geopolitical tensions surrounding international space cooperation. The leaked material reportedly included PDFs, spreadsheets, handwritten forms and descriptions of lunar missions.
The group gained unauthorized access to the web server and defaced the public‑facing page. The stolen data was packaged into a ZIP file and uploaded to a cloud storage service for distribution. Announcements and proof of the breach were shared via Twitter, notably through the account @YourAnonNews which is associated with Anonymous. No specific malware families, exploit kits or initial‑access vectors are described in the available reporting.
On 2022‑03‑03 v0g3lSec claimed responsibility for defacing an IKI subdomain and leaking a cloud‑hosted ZIP file purporting to contain Roscosmos data. The leaked archive reportedly contained PDFs, spreadsheets, handwritten forms and documents related to lunar missions. While the breach was confirmed by Anonymous‑linked sources, the authenticity of the leaked materials has not been independently verified. The incident is frequently cited as a representative example of the group’s public‑facing hacktivist activity.
Attribution to the Anonymous collective is supported by the group’s Twitter handle v0g3lSec being acknowledged by the Anonymous‑affiliated account @YourAnonNews. No public evidence ties v0g3lSec to a state sponsor or a criminal consortium. The actor’s public presence is limited to the Twitter handle and the claimed IKI breach.