Cyber Threat Actor: nofawkX-al

The threat actor known by the alias nofawkX-al has been associated with website defacement operations originating from Albania. Public reporting identifies the actor as an Albanian hacker who has targeted online assets in the United Kingdom and Romania. The incidents involve the compromise of official websites belonging to South Yorkshire Police and the Romanian Football Federation, with the actor replacing homepage content with nationalist messages and the Albanian double‑headed eagle emblem. In both cases the actor did not claim a financial or espionage motive, and the descriptions of the attacks characterize them as opportunistic rather than politically driven. No evidence has been presented linking the actor to any state‑sponsored program or organized criminal consortium.

The actor’s tactics, techniques and procedures appear limited to gaining unauthorized access to web servers and altering publicly visible content, a method commonly described as website defacement. No malware families, exploit kits, or specific tooling have been referenced in the available sources, and the reports do not detail initial access vectors such as phishing or vulnerability exploitation. The defacement messages consistently feature patriotic language and symbols, suggesting a thematic focus on national pride rather than covert data theft or financial gain. Attribution to the actor relies on the alias nofawkX-al used in the defacement notices and corroborated by media coverage of the two incidents. The most notable publicly reported operations are the June 2016 defacement of South Yorkshire Police websites and the June 2016 defacement of the Romanian Football Federation and its associated cup site, both of which were restored by the victims’ IT teams within hours. These cases represent the extent of the actor’s documented activity in the open‑source record.