Cyber Threat Actor: Spain Squad

Spain Squad is a hacker group that uses the alias Spain Squad and has been associated with operations originating from Spain. The group first came to public attention in September 2016 when it claimed to have discovered a method for seizing inactive and suspended Twitter accounts. Members of the group advertised the reclaimed handles for sale on underground markets, emphasizing the value of short or provocative usernames. They asserted control over accounts such as @Hell, @Hitler, @Nazi, @ak47 and @1337, among others. The group presented itself as a white‑hat team motivated by amusement rather than malicious intent.

Their activity focused exclusively on the Twitter platform, targeting accounts that had been suspended for rule violations or left dormant due to inactivity. By exploiting an undisclosed vulnerability, they were able to reactivate these usernames and transfer them to their own control, a capability not normally available through standard Twitter functions. The group claimed they could also suspend or unsuspend accounts and swap handles between users, although no independent evidence was provided to support these broader assertions. Financially, the operation appeared driven by the resale of the reclaimed handles, with notable offers such as the attempt to sell @megaupload to entrepreneur Kim Dotcom. No malware, specific tooling, or initial‑access vectors were described in the reporting, and the exploit remained undefined beyond the ability to seize dormant accounts.

The September 2016 incident represents the only publicly reported campaign attributed to Spain Squad, during which they resurrected several high‑profile handles before Twitter re‑suspended the accounts. The platform did not disclose whether the underlying vulnerability was patched, leaving the persistence of the flaw uncertain. Attribution to any state sponsor, criminal consortium or larger hacking alliance has not been established in open sources. Members identified themselves online, with one individual using the handle @Ziter and another speaking via the reclaimed @LizardSquad account under the name Akma. The group stated that their actions were intended for fun and that they would deactivate or suspend the accounts after the publicity, a claim that aligns with their self‑description as white‑hat actors.