Los Pelaos

Profile narrative

Los Pelaos is a threat actor that operates under the alias Los Pelaos and has been publicly linked to Spain. The group identifies itself as a criminal collective and uses the Twitter handle @LOSPELAOSBRO to claim responsibility for its activities and to communicate demands. Public reporting indicates that the actor’s known activity is limited to a series of unauthorized takeovers of artist channels hosted through Vevo’s content‑provider model on YouTube, which occurred in early April 2022. No further details about the group’s internal structure, size, or broader affiliations have been disclosed in open sources.

The actor’s observed targeting focuses on private entertainment entities, specifically high‑profile musician and artist YouTube channels managed by Vevo. The stated objective, as expressed in the group’s social‑media posts, is to advocate for the release of Paco Sanz, a Spanish individual convicted of fraud, while simultaneously asserting that the group does not attack governments and limits its actions to private companies. The activity resulted in altered video titles and the upload of unauthorized content that promoted the group’s message, but the actor did not access or modify pre‑existing videos on the compromised channels. The only tactics, techniques, and procedures explicitly referenced in the reporting involve gaining unauthorized control of Vevo‑associated YouTube accounts, uploading new videos with specific titles, and using Twitter to announce the hacks, solicit suggestions for future targets, and amplify their demands. No malware families, phishing vectors, or specific tooling have been described in the available sources.

The most notable campaign attributed to Los Pelaos took place on April 5 2022, when the group compromised the YouTube channels of numerous internationally recognized artists, including Rihanna, Justin Bieber, Taylor Swift, Kanye West, Drake, Eminem, Michael Jackson, Ariana Grande, Harry Styles, Travis Scott, The Weeknd, and Lil Nas X. The affected channels, which collectively serve hundreds of millions of subscribers, were used to upload videos bearing titles such as “Justin bieber – Free Paco Sanz (ft. Will Smith, Chris Rock, Skinny flex & Los Pelaos)” and “HACKED BY @LOSPELAOSBRO.” Vevo confirmed that all improperly uploaded videos were removed, that no pre‑existing content was accessed, and that it initiated a review of its security systems in response. The group continued to tweet about additional hacks and threatened further actions against private YouTube accounts, while maintaining a public stance that it avoids governmental targets. This incident remains the primary publicly documented operation associated with Los Pelaos.

Incidents

Attributed incidents are available to members.