Cyber Threat Actor: GO.ETH

GO.ETH is a threat actor publicly linked to disruptive cyber operations targeting media organizations, with its activities geographically associated with Uruguay. This alias has been claimed by perpetrators of website compromises involving politically motivated content manipulation, specifically through the replacement of legitimate web content with fabricated materials. The actor's confirmed targeting centers on television broadcasters and related media entities, with one documented incident impacting a broadcaster's digital platform to disseminate manipulated imagery and threats. Strategic objectives demonstrated in these operations emphasize public disruption and political messaging rather than financial gain or data theft, aligning with defacement-style attacks intended to undermine institutional credibility and amplify ideological narratives.

The group's tactics include compromising victim websites to replace authentic content with AI-generated falsified images designed to ridicule political figures, accompanied by explicit threats against entities like national commerce chambers. Public statements associated with these incidents reference prior breaches at unspecified media outlets, suggesting a recurring focus on this sector. No malware families, specific initial access vectors, or technical tooling details are explicitly documented in available reporting. Attribution remains limited to the actor's self-claimed GO.ETH identifier, with no confirmed state affiliations or criminal consortium ties disclosed in source material. The April 2025 attack on the television broadcaster represents a signature operation, illustrating the actor's use of synthetic media for coercion and its declared intent to sustain disruptive campaigns against perceived adversaries. Restoration efforts by victims and absence of disclosed data exfiltration further characterize these intrusions as primarily disruptive in nature.