Kkuq e zi

Profile narrative

The threat actor known by the alias Kkuq e zi is identified as a group of Albanian hackers who carried out a website defacement against the South Yorkshire Police in the United Kingdom. The actor’s location is noted as Albania, and the alias appears in the defacement message left on the compromised sites. The group’s activity is limited to the reported incident in which they gained unauthorized access to two official police websites and replaced the home pages with their own content. No additional aliases, affiliations, or organizational structure are disclosed in the available sources.

Regarding targeting, the only evidenced focus is on government‑related web properties, specifically police department sites within the UK region. The article does not specify any broader sectoral pattern, nor does it indicate a strategic objective such as financial gain, espionage, or sustained disruption; the motive for the attack is explicitly described as unknown. The defacement itself involved the placement of a custom page that included a text statement and a video message, through which the actors bragged about the success of the intrusion and referenced nationalist symbols such as the Illyrian heritage, red and black colors, and an eagle motif. No malware families, exploit kits, or specific initial access vectors are mentioned in the reporting, so the observed tactics are confined to web‑site defacement via unauthorized content replacement.

Public attribution to a state sponsor or criminal consortium has not been established; the actor remains unaffiliated in the open‑source record. The South Yorkshire Police incident represents the sole publicly reported operation attributed to Kkuq e zi, and it is cited as an example of their activity. The article notes that this was not the first time a UK police website had been compromised, referencing a separate Hertfordshire Police breach linked to OpFreeAssange, but that event is not directly tied to this actor. Consequently, the profile is limited to the confirmed facts of the alias, Albanian origin, the specific defacement of UK police websites, the nature of the defacement message, and the lack of publicly disclosed motives, tools, or affiliations.

Incidents

Attributed incidents are available to members.