Cyber Threat Actor: Tunisian Hackers

The threat actor known as Tunisian Hackers operates under the alias Tunisian Hackers and is based in Tunisia. They are publicly affiliated with the Anonymous collective, participating in its operations under the banner of the #OpWorldCup campaign. Their known activity is limited to a series of coordinated cyber attacks launched on June 17 2014 against various Brazilian institutions during the FIFA World Cup. The targeting focused on sectors such as energy utilities, telecommunications providers, media organizations, government agencies, and law‑enforcement portals, all located within Brazil. The strategic objective of these actions was not financial gain or espionage but rather to protest perceived corruption, misuse of public funds, and social inequality associated with the event, aligning with broader public demonstrations against FIFA and Brazilian authorities.

In terms of tactics, the group employed social engineering techniques to gain initial access to target networks, followed by system intrusions that enabled the exfiltration of sensitive data. The compromised information included names, email addresses, telephone numbers, hashed passwords, IP addresses, and internal operational documents, which were subsequently leaked online. No specific malware families or custom tooling are referenced in the available sources, indicating that their approach relied primarily on credential harvesting and direct system compromise rather than sophisticated malware deployment. Attribution to a state sponsor or criminal consortium is not evident; the actor’s affiliation is explicitly tied to the loosely organized Anonymous movement. The most notable campaign associated with Tunisian Hackers remains the #OpWorldCup operation, which exemplifies their pattern of hacktivist disruption aimed at highlighting political grievances through data leaks and service interference.