Cyber Threat Actor: hacker trojan

The threat actor known publicly as hAxOr tr0jAn operates under the alias Anon Ghost. This label has been used in open‑source reporting to identify a hacktivist collective that emerged in the mid‑2010s. The group first came to attention through a specific incident targeting Malaysian government online presences. No other aliases have been documented in the provided material.

In the July 2015 operation the actors focused on the social media channels of the Malaysian Police, a target within the public‑sector domain of Malaysia. The defacement was carried out to display Islamic State propaganda imagery and accompanying threatening messages directed at government officials. According to the group’s own statements the action was intended to demonstrate their technical capabilities and to signal ideological alignment with the Islamic State, while also expressing support for broader freedom movements. The group further emphasized that the breach was not undertaken for personal notoriety but to showcase their ability to influence online narratives. Financial gain or espionage was not cited as a motive in the reporting.

The tactics observed in this campaign involved unauthorized access to the police Facebook and Twitter accounts, followed by the replacement of profile pictures with Arabic text and ISIS‑affiliated symbols. The attackers then posted declarations that included the hashtag #AnonGhostWasHere and disseminated militant photos and threatening language. No specific malware families, exploit kits, or custom tooling were mentioned in the source material, indicating that the operation relied primarily on social‑media credential compromise and content posting.

Attribution in open‑source reports links the activity to the self‑described pro‑ISIS hacktivist group Anon Ghost, which explicitly distanced itself from the broader Anonymous collective and claimed opposition to Zionism and Israel. No public evidence connects the actor to a state sponsor or to a known criminal consortium; the affiliation remains limited to the ideological hacktivist framing expressed by the group itself. The 2015 Malaysian Police social‑media defacement stands as the sole publicly reported operation attributed to hAxOr tr0jAn under the Anon Ghost moniker in the available information.