Team Faceless Men
Attribution profile
- Type
- Sensationalist
- Location
- Turkey
- Known incidents
- 1 incident
- Sources
- 1 source
- First seen
- 2018-07-27
- Last seen
- 2018-07-27
- Updated
- 2026-10-03 00:10
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Team Faceless Men, also known by the alias used in the defacement “Dohaeragon,” is a threat actor group linked to Turkey. In July 2018 they defaced an externally hosted Kaiser Permanente health innovations subdomain, replacing its content with a Game of Thrones‑themed message and embedding the YouTube track “Hear Me Roar.” The attack exploited the site’s lack of routine security updates and unpatched software, allowing the actors to gain access without deploying malware or exfiltrating data; Kaiser Permanente confirmed that no protected health information or internal systems were compromised. The group’s members were identified as Turkish gamers with no prior notable hacking history, and there is no public evidence of state sponsorship or affiliation with a criminal consortium. The Kaiser Permanente incident remains their only publicly reported operation, representing a disruption‑oriented defacement aimed at reputational impact rather than financial gain or espionage.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 1 source.