Nemty

Profile narrative

The threat actor known by aliases including @n0w1337, Prince, Pr0digy, and pr0jekkt emerged in 2015 as a politically and ideologically motivated hacktivist operating in the English-language ecosystem. The earliest documented activity attributed to aliases associated with this actor consists of distributed denial-of-service (DDoS) attacks against UK law enforcement websites. The Essex Police website was disrupted for roughly thirty minutes on September 3, 2015, with the actor claiming credit via Twitter and describing themselves as a bored individual recently graduated from high school. The following day, the Greater Manchester Police website suffered two DDoS attacks that took it offline for approximately two hours, after which an account using the alias "Prince" claimed responsibility and threatened continued disruption, professing Lithuanian affiliation. These early incidents were characterized by public claim announcements on social media, taunting communications, and minimal technical sophistication beyond simple volumetric denial-of-service attacks. No evidence links the actor to data theft, intrusion operations, or ransomware activity.

Public reporting on subsequent operations associated with the actor's monikers and aliases indicates involvement in hacktivist-style DDoS campaigns rather than financially motivated cybercrime or espionage operations. Threat actor tracking articles reference the actor in connection with broader disruptive campaigns, including distributed denial-of-service activity against government, media, and corporate targets. Claimed operations through affiliated personas include attacks on Israeli infrastructure during periods of geopolitical tension, Swedish aviation and broadcasting entities following the burning of a Quran in Stockholm, and U.S.-based organizations framed as retaliation for perceived foreign policy actions. In several of these incidents, the actor communicated demands, issued threats of further disruption, and sought to generate media attention through public statements on Telegram and Twitter. The pattern of targeting reflects an intent to cause service disruption and attract publicity rather than to exfiltrate data, conduct espionage, or generate direct financial gain.

Attribution and affiliation information from the provided source corpus is limited. The actor's early activity was conducted under self-reported personal motivations, and later campaigns have been framed through political or religious justifications tied to specific geopolitical flashpoints. Some cybersecurity researchers have suggested possible links between the actor's operational persona and broader pro-Russian hacktivist ecosystems, based on overlapping target selection and coordination with groups such as UserSec, though these assessments remain tentative and have not resulted in definitive public attribution to a state actor or criminal consortium. There is no evidence in the source material connecting the actor to malware families, ransomware operations, or structured ransomware-as-a-service models. Operational tooling referenced in connection with the actor's claimed attacks consists almost exclusively of DDoS infrastructure, with no documented use of intrusion frameworks, post-exploitation toolkits, or data-extraction malware.

Notable representative campaigns associated with the actor's aliases include the 2015 attacks on Essex Police and Greater Manchester Police in the United Kingdom, the February 2023 cyberattacks against Scandinavian Airlines and Swedish public broadcaster SVT, coordinated DDoS activity against Israeli government, academic, and cybersecurity websites in April 2023, and claimed attacks on U.S. organizations including Microsoft Outlook services and the Electronic Federal Tax Payment System in mid-2023. Across these operations, the actor has consistently relied on public claim announcements, political or religious justifications, and threat-of-continuation messaging rather than demonstrating capabilities beyond service disruption.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 82 sources.