Cyber Threat Actor: AnonGhost

AnonGhost, operating under aliases including Anonymous #OpIsrael Participants and #OpIsrael, is a hacktivist collective primarily motivated by anti-Israeli and pro-Palestinian ideology, with later activities demonstrating alignment with ISIS objectives. The group systematically targets government, military, law enforcement, and commercial entities across Israel, the United States, Malaysia, and France. Their operations consistently aim to disrupt services, compromise data integrity, and disseminate political messaging through website defacements, credential leaks, and denial-of-service attacks. Strategic objectives center on ideological signaling—denouncing Israeli policies, protesting Western military actions in Muslim-majority regions, and supporting extremist causes—rather than financial gain or traditional espionage.

Notable tactics include exploiting unpatched content management systems for initial access, deploying remote access trojans like Dark Comet via socially engineered downloads, and leaking stolen data through platforms such as Pastebin. The group’s operations frequently align with coordinated campaigns like #OpIsrael, during which they compromised 700 Israeli websites in 2015, exfiltrating PayPal credentials, email databases, and citizen records. AnonGhost distinguishes itself from broader Anonymous collectives, emphasizing focused anti-Zionist operations while collaborating with factions like Anonymous Arab. Key incidents include infiltrating US Air Force subdomains to protest military policies, hijacking Malaysian police social media to promote ISIS imagery, and compromising multiple US sheriff department sites under #OpUSA. A 2017 evolution saw the group weaponize DDoS tools to deliver malware to fellow hacktivists, indicating adaptive tradecraft. Persistent themes include CMS exploitation, credential harvesting from government portals, and leveraging geopolitical events like the Chapel Hill shootings to justify attacks on Western institutions.