Cyber Threat Actor: Anonymous

Anonymous, also known as Anon, is a hacktivist collective that has been linked to a series of cyber operations targeting entities across multiple continents, with the threat actor’s location noted as Cyprus in the provided context. The group routinely adopts the Guy Fawkes mask as a visual signature and accompanies its actions with the slogan “We do not forgive, we do not forget, we are legion,” framing its activities as protests against perceived injustices or policy decisions. Public statements attached to the attacks cite motivations such as supporting Ukraine in its conflict with Russia, opposing Israeli government actions, protesting Japanese refugee policies, defending pro‑democracy demonstrations in Guatemala, and reacting to alleged surveillance programs conducted by Russian security services. These declarations indicate that the collective’s strategic objectives are primarily disruptive and advocative rather than financially motivated, aiming to draw attention to political or social causes through cyber means.

The group’s observed targeting spans a broad range of sectors and geographic regions. Incidents have included defacements and distributed denial‑of‑service attacks on media organizations such as Embarcadero Media Group in the United States and the Ayuntamiento de Tepotzotlán’s Facebook page in Mexico, as well as intrusions against governmental bodies in Israel, Paraguay, Guatemala, Japan, Sweden, Iran, and Russia. In the Russian sphere, Anonymous has repeatedly claimed responsibility for leaking data from state institutions—including the Ministry of Culture, the Ministry of Defense, and the Federal Security Service‑linked ISP Convex—as well as from private companies such as Gazprom, Yandex Taxi, various banks, and energy firms. The tactics observed across these operations consist of website defacement with political messages, distributed denial‑of‑service or load‑based attacks that render online services unavailable, the exfiltration and publication of internal emails and documents via platforms like DDoSecrets, and phishing attempts that masquerade as virus warnings to harvest credentials during service outages. The collective also leverages affiliated handles and subgroups—such as Anonymous TV (@YourAnonTV), @YourAnonNews, @DepaixPorteur, Network Battalion 65, GhostSec, and NB 65—to amplify its claims and distribute leaked material.

Notable campaigns referenced in the source material include the ongoing OpRussia initiative, which has produced multiple large‑scale data leaks from Russian governmental and corporate entities, including the Ministry of Culture (over 400 GB), Gazprom, several banks, and energy companies, often accompanied by statements linking the leaks to opposition of Russia’s invasion of Ukraine. Another prominent effort involved the defacement of Israeli Ministry of Justice systems and Paraguay’s National Institute of Statistics website, where anti‑Israel messages were posted amid regional tensions. In Guatemala, Anonymous‑linked actors launched DDoS attacks against judicial and agricultural government sites in support of Indigenous‑led pro‑democracy protests. The group also targeted Japanese Ministry of Justice services to protest refugee policies, disrupted the Swedish parliament’s website with a load‑based attack, and launched pro‑Ukraine DDoS campaigns against Iranian government and energy sector sites, including the national oil company and Iran Airlines, in retaliation for Iranian drone supplies to Russia. Additional operations have compromised law‑enforcement‑related platforms such as ODIN Intelligence’s SweepWizard application, resulting in the alleged exfiltration of police data and alleged AWS keys, and have affected Russian private enterprises like Yandex Taxi, which was manipulated to create a traffic jam in Moscow. Throughout these activities, the collective has consistently used the DDoSecrets repository to publish stolen data and has employed affiliates to claim responsibility for specific breaches.

Attribution to Anonymous is based on the group’s self‑identification in the reported incidents, the recurrent use of its iconography and slogans, and the acknowledgment of affiliated accounts such as Anonymous TV and Network Battalion 65 in the source material. No explicit state sponsorship or linkage to a particular government is described in the provided information; the collective is characterized solely as a hacktivist entity. The location noted for the actor is Cyprus, although the operational scope demonstrated in the incidents extends well beyond that jurisdiction, reflecting the transnational nature of the group’s activities.