Kuroi'SH
Attribution profile
- Type
- Activist
- Location
- France
- Known incidents
- 5 incidents
- Sources
- 5 sources
- First seen
- 2015-10-13
- Last seen
- 2018-04-10
- Updated
- 2026-10-11 01:31
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor operates under the aliases KuroiSH and Amar^SHG and is known to be based in France. Targeting has included a national weather service (Météo France), a video‑hosting platform (Vevo YouTube), an airline (Asiana Airlines), a major search engine (Google Brazil), and a U.S. military‑affiliated university (Uniformed Services University). The actor has stated that actions are intended to promote peace, spread political messages (e.g., pro‑Serbian content), demonstrate that any system can be hacked, and support the Palestinian cause, indicating disruption and activism rather than financial gain or espionage. Observed techniques involve SQL injection against a domain registrar’s extranet to gain defacement access, DNS hijacking via a hosting provider to redirect traffic, website defacement with political messages, takeover of social‑media accounts (Twitter) associated with compromised services, and the exfiltration and publication of plaintext credentials. No public attribution to a state sponsor or criminal consortium has been made. Representative campaigns are the 2016 SQL injection defacement of Météo France, the 2018 Vevo YouTube and Twitter account hijacking, the 2017 DNS hijacking of Asiana Airlines’ site, the 2017 DNS hijacking of Google Brazil, and the 2015 breach of Uniformed Services University that leaked 2014 login credentials.
Incidents
Attributed incidents are available to members.
5 incidentsSources
Sources available to members: 5 sources.