Phenomene dz

Profile narrative

Phenomene dz is the alias used by an actor that publicly describes itself as an Islamic state hacker on Twitter and has been linked to the self‑proclaimed Islamic State (ISIS) propaganda effort. The actor operates from Italy, as indicated by the Italian language sources that reported the incidents and the geographic concentration of the attacks. No further personal details, organizational structure, or leadership information are publicly available.

The actor’s activity has been observed mainly against weakly protected websites in the Tuscany region of Italy. Targets have included cultural institutions such as the Accademia della Crusca, a regional political party identified as the Pd regionale, and educational establishments like a school. The intrusions were framed as retaliation against Western governments and were used to disseminate ISIS propaganda, including defacement with extremist symbols, a video depicting injured children, and messages such as “I love Islamic State!” and anti‑Western rhetoric that quoted statements about America, Iran, Zionists and Muslims in various conflict zones. After the defacement the Accademia della Crusca site was restored to normal operation, and security forces confirmed that the victim institutions were not directly selected for targeting but were caught opportunistically.

The attacks exhibit a low‑sophistication style, relying on online programs or scripts that scan for and exploit sites lacking adequate security protections, a approach described by investigators as a dragnet‑like campaign. Initial access appears to be achieved through exploiting known vulnerabilities or weak configurations rather than through bespoke malware or spear‑phishing campaigns. The actor uses social media platforms, particularly Twitter, to claim responsibility and to broadcast its allegiance to ISIS. Investigators have linked the activity to international hacker collectives that produce and distribute such tools online, noting that the incidents are not part of a focused, state‑sponsored campaign but rather opportunistic vandalism. Representative operations include the June 2015 defacement of the Accademia della Crusca website and comparable incidents against the Pd regionale site and a school site in Tuscany, all of which were attributed to the same alias and shared the same propaganda content.

Incidents

Attributed incidents are available to members.