Cyber Threat Actor: AnonGhost

AnonGhost, also known as AnonGhost Team, emerged as a pro-Palestinian hacktivist collective before aligning with pro-Islamic State (ISIS) ideology by mid-2015. The group publicly distinguished itself from Anonymous, declaring divergent goals and claiming superiority in hacking capabilities. They framed their activities as resistance against perceived oppression, self-identifying as "the sound of the forgotten people" and "freedom fighters in the cyber world," with explicit focus on opposing Zionism, Israel, and later promoting ISIS propaganda. Their operations consistently featured anti-government rhetoric, condemning the United Nations and multiple nations for human rights violations and military actions in Muslim-majority regions.

The group primarily targeted government entities, law enforcement agencies, and Israeli institutions across multiple continents. High-profile victims included Malaysia's Royal Police (social media accounts), U.S. Air Force subdomains, Israeli Agricultural Research Organization, Connecticut state government portals, and French Ministry of Interior/Defense digital assets. Private sector compromises included Red Bull Malaysia and Israeli newspaper Haaretz. Regional focus spanned Southeast Asia, North America, Europe, and the Middle East, with strategic objectives centered on disruption, propaganda dissemination, and symbolic retaliation rather than financial gain. Notable exceptions involved stealing and donating $18,000 from Israeli credit cards to pro-Palestinian charities during OpIsrael campaigns. Operations frequently coincided with geopolitical events, such as NATO actions, Gaza conflicts, and the Chapel Hill shootings, amplifying their political messaging through coordinated timing.

AnonGhost's tactics relied heavily on website defacements, credential leaks, and database breaches, often exploiting outdated content management systems. They publicly leaked login credentials from U.S. sheriff's offices, Israeli payment systems, and social media accounts, frequently mirroring defaced pages via Zone-H. The group collaborated with other hacktivist collectives like Anonymous Arab during OpIsrael, which saw 700+ Israeli websites compromised and thousands of credentials leaked in 2015. While no custom malware was documented, their operations demonstrated consistent web application targeting and moderate technical proficiency. Affiliation shifts occurred from Palestinian solidarity to ISIS support by 2015, evidenced by Malaysian Police social media propaganda featuring Islamic State imagery and messages. French authorities attributed their 2015 anti-Charlie Hebdo campaign to the group, which targeted government sites under the "Anti #CharlieHebdo" operation. AnonGhost maintained persistent activity from at least 2014 through 2015, with operations declining in visibility after coordinated takeovers of high-value government domains.