Cyber Threat Actor: VikingDom2016

The threat actor known publicly as VikingDom2016 also uses the alias ThreatKing and has been linked to activity originating from the United States of America. The actor first came to public attention in July 2015 when it claimed responsibility for disrupting the website of New York Magazine. The claim was made via a Twitter account associated with the ThreatKing handle. No independent verification of the actor’s identity or broader affiliations has been presented in open sources.

In the claimed operation the actor targeted a media organization, specifically the news outlet New York Magazine, which is based in New York City. The actor described the motive as stemming from personal knowledge of one of the women featured on the magazine’s cover and from broader grievances against the city itself. The actor also stated that the attack was intended to generate maximum attention and to signal that the magazine was only the first target. These statements were made directly by the individual using the ThreatKing pseudonym during a Twitter exchange. The actor further claimed that the disruption was meant to silence the outlet following its publication of allegations against Bill Cosby.

The actor explained that the disruptive action consisted of flooding the target’s server with overwhelming requests to render it unavailable. No mention of malware, exploit kits, or specific intrusion tools appears in the reporting, and the described method aligns with a volumetric network‑level assault. Communication with victims and publicity of the claim were conducted through the social‑media platform Twitter. No additional tooling or infrastructure details have been disclosed in publicly available sources.

The reported impact of the attack included roughly twelve hours of downtime for nymag.com, during which magazine staff could not access corporate email systems. To maintain availability of the exposé, the magazine republished the women’s accounts on Tumblr and posted video interviews on Instagram while publicly describing the interruption as technical difficulties. The actor’s message that “Ny mag, Is just the start” suggested an intention to pursue further actions, though no subsequent operations attributed to VikingDom2016 have been documented in open sources. This incident remains the sole publicly cited campaign linked to the alias.