Cyber Threat Actor: AnonymousCorrupt

The threat actor known by the aliases AnonymousCorrupt and Corrupt operates from the United States of America and is publicly linked to the Anonymous collective through its New World Hacking team (NWH) designation. This group identifies itself as a hacktivist outfit that conducts operations against entities it perceives as withholding information of public interest. The actor’s public statements frame its actions as part of a broader campaign against government cover‑ups, which it labels Operation Censorship or #OPCensorship. No further structural hierarchy or sponsorship has been disclosed in open sources.

Targeting patterns observed in reported incidents include government agencies, major online services, media outlets, financial institutions, political campaigns, and law‑enforcement or transportation infrastructure. Specific victims cited by the actor consist of NASA’s website and email servers, the Xbox online service, BBC news servers, HSBC UK’s online banking portal, the official site for Donald Trump’s election campaign, and the websites of Salt Lake City Police and the local airport. The actor claims its motivation is to compel targets to disclose information it believes is being withheld, notably alleging that NASA is holding back details about ISIS that the public should know. These statements indicate a disruption‑oriented objective coupled with a hacktivist goal of forcing transparency.

The primary technique referenced in the actor’s public claims is a distributed denial‑of‑service (DDoS) attack, which it describes as the most commonly used weapon in its operations. The group asserts that it generated sufficient traffic to produce aftershocks on the targeted systems, even when the victim’s front‑end remained accessible. No specific malware families, exploit kits, or alternative initial‑access vectors are mentioned in the available sources.

Representative operations attributed to the actor include the March 2016 DDoS effort against NASA that it said shut down the agency’s primary website and email servers, a claim NASA did not confirm. The actor also says it previously disrupted the Xbox online service, BBC news servers, HSBC UK’s online banking, the Trump election campaign website, and the Salt Lake City Police and airport sites, presenting these as proof of its capability. It has linked these actions to its Operation Censorship initiative and indicated plans to target additional figures, such as a promised follow‑up against Donald Trump on April Fools’ Day. These episodes constitute the actor’s publicly reported campaign history.

Attribution to a state sponsor or a formal criminal consortium has not been established in open reporting; the actor is described solely as an Anonymous‑affiliated hacktivist collective with a base in the United States. The New World Hacking team label is used by the group to claim responsibility for the incidents discussed, but no further hierarchical ties or funding sources are disclosed. Consequently, the actor’s public profile rests on its self‑described motives, its use of DDoS tactics, and the series of high‑profile disruptions it has claimed.