nofawkX-al

Profile narrative

The threat actor known by the alias nofawkX-al has been linked to a series of website defacements originating from Albania. Public reporting identifies the actor as an Albanian individual or group operating under that moniker. No further personal details such as real name, age, or organizational ties have been disclosed in open sources. The actor’s geographic base is noted only as Albania, with no indication of foreign direction or support.

Targeting has focused on public‑sector websites in Europe, specifically law‑enforcement and sports‑governance domains. The observed victims include the South Yorkshire Police website in the United Kingdom and the Romanian Football Federation and its associated cup site in Romania. The actor’s actions appear intended to disrupt normal service and to display a nationalist message rather than to pursue financial gain or espionage. No public statements or evidence suggest a motive tied to profit, data theft, or state‑directed objectives.

The reported tactics involve gaining unauthorized access to web servers and replacing the homepage with a custom defacement page. The defacement page contains a textual proclamation in English that references Albanian pride, the red and black colors, and the double‑headed eagle emblem. No mention is made of malware deployment, exploit kits, or specific hacking tools in the available descriptions. The actor’s methodology is limited to the defacement vector, with no reported use of persistence mechanisms or lateral movement after the initial alteration.

Two distinct campaigns have been documented: the June 2016 defacement of South Yorkshire Police sites and the June 2016 defacement of the Romanian Football Federation and its cup site. Both incidents occurred within a short timeframe and were accompanied by similar nationalist messaging, suggesting a recurring pattern of opportunistic targeting. Attribution to any state sponsor, criminal consortium, or hacker collective has not been established in public reporting. Consequently, the actor remains classified as an independent defacer whose activities are confined to website vandalism for symbolic purposes.

Incidents

Attributed incidents are available to members.