Cyber Threat Actor: Ghost Squad Hackers (GSH)

Ghost Squad Hackers (GSH), also operating as Ghost Squad or Ghost Squad Hackers, is a hacktivist collective originating from the United States. The group has conducted cyber operations since at least 2016, primarily leveraging website defacements, distributed denial-of-service (DDoS) attacks, and data leaks to advance ideological or social justice causes. GSH has targeted government, military, financial, and scientific entities across multiple regions, including Afghanistan, Israel, the European Union, and the United States. Their operations often align with political grievances, such as protesting alleged government corruption or human rights abuses, though they have also claimed attacks for entertainment purposes. The group has intermittently affiliated with broader hacktivist movements like Anonymous, participating in coordinated campaigns such as #OpIcarus and #OpSilence.

GSH’s targeting focuses on high-visibility entities, exploiting vulnerabilities to amplify their messages. In 2016, they executed a coordinated defacement of twelve Afghan government websites—including the Ministries of Defense, Foreign Affairs, and Justice—by exploiting a shared server vulnerability. The attack displayed anti-government messages criticizing Afghanistan’s alleged drug ties with the U.S. and mistreatment of citizens, promoted through hashtags like #Justice4Afghans. Similarly, in 2020, the group defaced a European Space Agency (ESA) subdomain by exploiting a server-side request forgery (SSRF) vulnerability, though they framed this attack as non-political and solely for entertainment. GSH’s technical methods include SSRF exploitation, DDoS attacks, and leveraging common server misconfigurations, often prioritizing disruption over data exfiltration. Their operations extend beyond defacements, such as leaking U.S. military personnel data—including names, emails, and credit card details—during #OpSilence, a campaign targeting mainstream media outlets like CNN and FOX News for perceived biased reporting. The group has also targeted non-state entities, launching DDoS attacks against both Ku Klux Klan and Black Lives Matter websites, citing opposition to racism “in any form.” While GSH’s actions reflect hacktivist themes of digital protest, their tactics lack consistent political alignment, alternating between sociopolitical advocacy and opportunistic disruptions.