Cyber Threat Actor: Phenomene dz

The threat actor known as Phenomene Dz operates under that alias and has also identified itself as an Islamic state hacker on social media platforms. Public reporting links the alias to individuals located in Italy, specifically referencing activities observed in the Tuscany region. The actor publicly aligns itself with the Islamic State (ISIS) ideology, using propaganda symbols and statements to promote the group's narrative. This self‑described affiliation is evident from the defacement messages that include phrases such as “I love Islamic state!” and calls for jihadist action. No evidence in the open sources indicates a direct state sponsor or criminal consortium backing the actor.

Targeting appears to focus on weakly protected websites rather than specific organizations, with attacks observed against cultural, political and educational entities. The sectors hit include a cultural institution (the Accademia della Crusca), a regional political party site and a school website, all situated in Tuscany. The strategic objective demonstrated in the incidents is ideological disruption through defacement, aiming to spread ISIS propaganda and convey threatening messages. The actor’s tactics involve exploiting inadequate web‑site defenses to insert ISIS‑related imagery, videos of injured children and textual slogans. No mention of malware families, exploit kits or advanced tooling appears in the reporting; the activity is characterized as low‑sophistication web defacement.

A representative operation occurred on June 22 2015 when the Accademia della Crusca’s site was defaced with ISIS symbols, a video of injured children and the statement “I love Islamic state!” accompanied by extremist rhetoric. Similar low‑level defacements were reported against the regional Partito Democratico site and a school website in the same area, forming a pattern of opportunistic attacks on poorly secured online assets. Investigators have attributed these actions to international hacker collectives that deploy simple scripts to locate and compromise vulnerable websites, rather than to a focused campaign targeting specific victims. The actor’s public claims on Twitter and the defacement content are the primary basis for linking Phenomene Dz to the broader ISIS‑sympathetic hacker milieu. Consequently, the profile of Phenomene Dz remains that of an ideologically motivated, low‑sophistication defacement actor active in Italy’s Tuscany region.