Cyber Threat Actor: Th3Falcon

The alias Th3Falcon appears in public reports as a nickname used by members of the hacktivist group Anon Ghost. Anon Ghost describes itself as a pro‑ISIS collective that seeks to advance extremist ideology through online actions. The alias was first observed in connection with a social media defacement carried out in mid‑2015. No identifiable personal information such as real names, ages, or nationalities has been disclosed for the individuals behind Th3Falcon. The name is employed primarily when the group claims responsibility for specific operations in statements posted after the fact.

On 13 July 2015 Th3Falcon, speaking for Anon Ghost, compromised the official Facebook and Twitter accounts of the Malaysian Police. The attackers replaced the profile pictures on both platforms with Arabic text and symbols associated with the Islamic State. They posted a series of images depicting militant fighters and added threatening messages directed at Malaysian government officials. A hashtag declaring “#AnonGhost was here” was included in the posts, and the group explicitly distanced itself from the broader Anonymous movement. In their statement the actors said the hack was intended to demonstrate their technical capabilities and to show ideological support for the Islamic State, while also expressing opposition to Zionism and Israel and framing the act as backing global freedom movements. After the incident the compromised accounts were restored by the social media providers, and the defaced content was removed.

Open source descriptions of the Th3Falcon operation do not mention any specific malware, exploit tools, or initial access techniques, so no concrete tactics, techniques, or procedures can be cited from the available material. Public reporting has not linked Anon Ghost or the Th3Falcon alias to any state sponsor or to a known criminal consortium, leaving the group’s affiliation undefined beyond its self‑described hacktivist and extremist orientation. The Malaysian Police defacement remains the most prominently documented campaign associated with Th3Falcon, illustrating the use of social media account hijacking as a means to spread propaganda. Following the restoration of the accounts, no further operations publicly attributed to Th3Falcon have been reported in reputable sources. This concludes the factual profile based solely on the information provided in the source.