Hagash Team

Profile narrative

Hagash Team is a threat actor known by that alias and is based in the United States of America. The group is publicly linked to the Anonymous hacktivist collective, with references to an affiliated entity called Anonymous Globo that expressed support for Baltimore protests. Their location and affiliation are drawn from open source reporting that connects their activities to the broader Anonymous network during periods of civil unrest.

The actor’s observed targeting focuses on law enforcement and municipal government entities within the United States, specifically the Baltimore Police Department. In April 2015 they breached the department’s servers and leaked email addresses and internal IP addresses onto Pastebin, an act that could enable phishing or denial‑of‑service activity against the agency. A subsequent disclosure in May 2015 revealed passwords for seven Baltimore Police Department email accounts, with the group claiming that victims of an earlier leak had inadvertently supplied those credentials through a phishing trap. These actions indicate a focus on obtaining and exposing credentials rather than deploying malware or pursuing financial gain.

Hagash Team’s typical tactics involve phishing to harvest credentials and then using public paste sites to publish the stolen data. The group’s communications reference a message stating “We are back, thanks for getting our spam and return with their passwords,” showing they leverage social engineering to obtain passwords before publishing them. No specific malware families, exploit kits, or custom tooling are mentioned in the available sources; their tooling style appears limited to credential phishing and the use of Pastebin for data leakage.

A notable campaign attributed to Hagash Team is the Baltimore Police Department incident that began with a server breach on April 28 2015 and continued with the Pastebin leak of email addresses and passwords on May 5 2015. This operation coincided with public statements from Anonymous Globo announcing cyber‑attacks against the same department in support of the Baltimore protests, linking the activity to a broader hacktivist effort during that period. The group’s actions are therefore presented as part of a coordinated series of disclosures targeting local government infrastructure during civil unrest.

Attribution to Hagash Team rests on their self‑identification in the Pastebin posts and their explicit association with Anonymous and Anonymous Globo in the reporting. No state sponsorship or criminal consortium ties are documented in the open source material; the actor is described solely as a hacktivist collective operating within the United States. Their known activities remain confined to credential theft and public disclosure aimed at disrupting targeted organizations.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.