Cyber Threat Actor: Graham Clark

Graham Clark, also known asGraham Ivan Clark, is a threat actor located in the United States of America. He is publicly identified as the alleged mastermind behind a high‑profile Twitter account compromise that occurred in July 2020. His aliases appear in legal documents and media coverage related to that incident and subsequent court proceedings.

The Twitter compromise targeted verified accounts belonging to prominent individuals and organizations across multiple sectors, including technology, finance, entertainment, and politics. The attackers used social engineering to trick Twitter employees who possessed access to internal systems and tools, then leveraged those internal tools to take over the accounts. The compromised accounts posted messages promoting a cryptocurrency scam that directed followers to send funds to a blockchain address in exchange with the promise of a larger return, resulting in over $100,000 collected from hundreds of transactions. This indicates a financially motivated objective rather than espionage or pure disruption.

In addition to the Twitter operation, Clark was the subject of a virtual bond hearing in Hillsborough County, Florida, on August 6 2020, which was disrupted when unauthorized participants injected disruptive audio, video, and explicit content into the Zoom proceeding. The disruption was attributed to insufficient security settings that allowed attendees to share unsolicited media, highlighting vulnerabilities in remote court videoconferencing. No public attribution links Clark to a state‑sponsored group or a known criminal consortium; he is described solely as an individual actor involved in the cited incidents. The Twitter hack remains his most extensively reported operation, illustrating a pattern of credential abuse via social engineering and internal tool misuse to achieve financial gain.