Legion

Profile narrative

Legion is a pseudonymous hacker group that has claimed responsibility for several high‑profile social‑media account compromises. The actors describe themselves as a new collective of international Blackhats whose stated purpose is to expose what they characterize as a corrupt system. They have publicly denied allegations of blackmail or financial extortion related to their operations. The group does not use any other publicly known alias in the sources examined.

Legion’s targeting, as described in their own statements, focuses on prominent Indian figures such as businessman Vijay Mallya and politician Rahul Gandhi. They assert that the goal of these intrusions is to reveal sensitive personal and financial information in order to highlight perceived corruption, rather than to pursue monetary gain. The actors explicitly rejected the idea that their actions were motivated by extortion, framing the leaks as a form of activism aimed at undermining confidence in targeted individuals.

The tactics, techniques and procedures referenced by Legion center on the claimed use of an undisclosed zero‑day vulnerability to gain control of Twitter accounts. After gaining access, they reportedly exfiltrated personal data, including addresses, phone numbers, banking details and business holdings, and then released the information publicly. No specific malware families, exploit kits or custom tooling are mentioned in the available reporting, and the group’s methodology appears limited to account takeover and data disclosure.

The most notable operation attributed to Legion is the compromise of Vijay Mallya’s Twitter account, during which they leaked a cache of his personal and sensitive information. The group also claimed to have accessed Rahul Gandhi’s Twitter account and threatened to release further material concerning Mallya and the Indian National Congress party. No definitive links to a state sponsor, criminal syndicate or other affiliated entity have been established in the public record, and Legion characterizes itself as an independent international collective of Blackhat actors.

Incidents

Attributed incidents are available to members.