GO.ETH

Profile narrative

GO.ETH is a threat actor known by that alias and has been publicly linked to Uruguay, where the individual or group operates. The actor first came to attention through a cyberattack on the Uruguayan television outlet TV Ciudad on April 24 2025, in which the website was compromised and replaced with AI‑generated fake images of politicians accompanied by intimidating messages and threats toward the Chamber of Commerce. Prior to this incident, GO.ETH was identified as responsible for similar intrusions on the news sites Brecha and El País, indicating a pattern of targeting Uruguayan media organizations. The actor’s public statements claim that the actions are directed at institutions they perceive as oppressive and that they intend to continue such targeting. No evidence has been presented linking GO.ETH to a state sponsor or a larger criminal consortium, and the actor’s affiliation remains unattributed in open sources.

The targeting observed so far is confined to the media sector within Uruguay, with the apparent strategic objective of causing disruption and delivering political intimidation rather than financial gain or espionage. The tactics demonstrated involve gaining unauthorized access to web servers to deface the sites, inserting AI‑generated visual content, and posting threatening textual messages. No specific malware families, exploit kits, or tooling have been disclosed in the reported incidents, and the initial access vectors have not been detailed in public sources. The actor’s approach appears to rely on web‑application compromise to achieve visibility and disseminate propaganda, without indications of data exfiltration or persistent footholds in the victim networks.

Representative operations attributed to GO.ETH include the defacement of TV Ciudad’s website in April 2025, the earlier compromises of Brecha and El País, and the accompanying statements that frame the activity as a continuation of a campaign against perceived oppressive entities. These incidents collectively illustrate a recurring pattern of media‑focused website disruption intended to convey political messages and sow uncertainty. While the actor has not been linked to any broader campaign beyond these specific events, the repeated targeting of Uruguayan news outlets suggests a sustained focus on that sector and geography. No further details regarding additional participants, infrastructure, or subsequent activities have been made publicly available.

Incidents

Attributed incidents are available to members.