H3ll C0D3
Attribution profile
- Type
- Activist
- Location
- Egypt
- Known incidents
- 1 incident
- Sources
- 1 source
- First seen
- 2014-08-27
- Last seen
- 2014-08-27
- Updated
- 2026-10-17 08:26
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
H3ll C0D3 is an Egyptian hacker alias used by a group that also identifies as i‑Hmx, Egyptian.H4x0rZ and ./Eg‑R1z Cr3w. The actor came to public attention in August 2014 when it defaced the HackForums website, a popular forum for cybersecurity enthusiasts and malicious actors hosted in Europe, by exploiting an unspecified server vulnerability to replace the site’s content with a 403 Forbidden error message and taunting remarks, causing several hours of downtime and lingering performance issues. The defacement message suggested a security warning to the forum’s administrators, though the precise motive remains unclear. No malware families, specific initial‑access vectors, or tooling styles beyond the vulnerability exploit and defacement are described in the reporting, and no public links to state sponsors or criminal consortia have been established. The HackForums incident remains the only publicly reported operation attributed to H3ll C0D3.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 1 source.