Cyber Threat Actor: Ashiyane Digital Security Team

The threat actor known as Shadow_Walker58 operates under the alias Ashiyane Digital Security Team and is based in Iran. The group first came to public attention through a series of website defacements targeting U.S. municipal entities. Their activity is characterized by the placement of defacement pages that include a pro‑Iran statement and the signature Shadow_Walker58 was here.

The actors primarily target local government websites in the United States, as evidenced by attacks on the City of Clarkston in Georgia and the Oregon cities of Amity and Sutherlin. The attacks resulted in the disruption of the targeted websites, rendering them inaccessible until remediation. No evidence of financial gain or espionage objectives is present in the reporting; the defacement included a pro‑Iran statement and the actor’s signature. The publicly available reports do not reference any malware families, exploit kits, or specific tooling associated with these operations.

The most widely reported incident occurred on September 15, 2014, when the official website of Clarkston, Georgia was defaced with a message reading “We love Iran. Hacked by Ashiyane Digital Security! Shadow_Walker58 was here”. Prior to that, the same group had claimed responsibility for defacements of the City of Amity and Sutherlin city websites in Oregon, indicating a pattern of repeated attacks on similar targets. Public attribution links the activity to an Iranian‑based hacking collective, though no formal state sponsorship or criminal consortium affiliation has been disclosed in the available sources.