Cyber Threat Actor: The Mallu Soldiers

The threat actor is known by several aliases thathave appeared in open‑source reporting, including Indian Hackers Online Squad, The Mallu Soldiers, Cyber warriors and The Mallu Cyber Soldiers, and is based in India according to the available context. These names refer to loosely affiliated hacktivist collectives that have carried out website defacements and online protests in response to perceived political provocations, particularly those related to the Kashmir dispute. The groups operate without a clear hierarchical structure and are described in the sources as acting in retaliation for earlier cyber incidents targeting Indian entities. Their activities are characterized by coordinated defacement campaigns that aim to display national symbols and political messages on the compromised sites of their adversaries.

Targeting has been observed primarily against Pakistani government, educational, military‑related and political party websites, as well as utility infrastructure such as the Pakistan Electric Power Company. The actors’ stated objectives, as expressed in the defacement messages, are to retaliate against perceived insults to Indian symbols or figures, to assert political positions on Kashmir, and to cause disruption by rendering the targeted sites temporarily inaccessible or by replacing their content with propaganda. No evidence in the provided material points to financial gain, espionage, or the use of sophisticated malware; the reported tactics involve gaining unauthorized access to web servers to alter homepage content, often by uploading images of national flags, photographs of public figures, and accompanying textual statements. While the actors have acted in concert with other Indian hacking groups such as Team Hind Hackers and Hell Shield Hackers, no public attribution to a state sponsor or a formal criminal consortium has been established, and the activity remains categorized as hacktivist rather than state‑directed or financially motivated. Representative operations include the September 2015 defacement of over forty Pakistani government and educational sites following a Pakistani hacker’s alteration of a Kerala government portal, and the October 2014 coordinated compromises of the National University of Modern Languages Lahore, the Pakistan Electric Power Company website, and the Pakistan Peoples Party’s official site, each featuring flag imagery, film dialogue, and politically charged warnings. These incidents illustrate the actor’s pattern of using website defacement as a means of political signaling and retaliation within the broader India‑Pakistan cyber conflict landscape.