Spectre123

Profile narrative

The threat actor known by the alias Spectre123 has been observed operating from Russia, according to available location information. The actor first came to public attention in October 2020 when a post attributed to Spectre123 appeared online claiming responsibility for a data leak. The leaked material reportedly originated from NATO entities and a Turkish defense manufacturer, specifically Havelsan. Researchers from the cybersecurity firm Cyble identified the post and analyzed the disclosed documents.

The disclosed files included statements of work, proposals, contracts, three‑dimensional designs, résumés, Excel spreadsheets with raw‑materials data, and financial statements. Researchers noted that the messaging accompanying the leak suggested a hacktivist motive, but they also stated that nation‑state involvement could not be ruled out. The article referenced prior warnings from the United Kingdom in May 2019 about Russian hacking activities targeting NATO allies. It also cited reports from September 2020 describing Russian‑linked intrusions against government agencies in NATO member countries and partner nations.

Because the leak did not involve malware, exploit tools, or specific intrusion techniques, no particular malware families or initial‑access vectors are described in the source material. Attribution to any state sponsor or criminal consortium remains unconfirmed in public reporting, with analysts only pointing to contextual similarities with previously reported Russian cyber operations. The NATO‑Turkey data leak of October 2020 stands as the sole publicly reported operation linked to the Spectre123 alias to date.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.