CSIDB logo
Threat actor

Sudoh4k3rs

Attribution profile

Type
Activist
Location
Portugal
Known incidents
1 incident
First seen
2015-02-27
Last seen
2015-02-27
Updated
2026-07-31 05:36
Aliases
1 alias

STIX characteristics

Threat actor characteristics are available to members.

Profile narrative

Sudoh4k3rs is a hacktivist group that operates under the alias Sudoh4k3rs and has been linked to Portugal, where the group’s activities have been reported. The collective describes itself on social media as a set of hacktivists opposed to what it characterizes as corrupt governments in Portugal and worldwide, stating that its goal is to serve the people. This self‑portrayal frames its actions as a form of political protest rather than financially driven crime. The group’s public statements emphasize opposition to governmental corruption and a desire to influence policy through cyber means.

In terms of targeting, Sudoh4k3rs has focused on governmental and academic institutions, as evidenced by its 2015 breach of the University of Lisbon’s Institute of Social Sciences. The attack resulted in the disclosure of administrative passwords that granted access to the university’s website, a tactic intended to pressure authorities into releasing seven individuals arrested for alleged ties to Anonymous Portugal. The group explicitly linked the intrusion to a demand for the detainees’ freedom and warned that further cyber actions against governmental and academic targets would continue until those demands were met. No specific malware families, initial access vectors, or tooling details are mentioned in the available sources, so the described TTPs are limited to unauthorized system access followed by credential leakage.

The only publicly documented operation attributed to Sudoh4k3rs is the February 27, 2015 incident against the University of Lisbon, which followed a police crackdown on suspected Anonymous Portugal members. The group’s affiliation appears to be ideological rather than organizational, with no evidence of state sponsorship or membership in a larger criminal consortium presented in the reporting. Consequently, the actor’s known profile rests on its claimed hacktivist motive, its focus on disrupting governmental and academic services to achieve political objectives, and the single confirmed campaign that illustrates its capability of the University of Lisbon password leak.

Incidents

Attributed incidents are available to members.

1 incident
CSIDB