Cyber Threat Actor: Kkuq e zi

Kkuq e zi appears in the defacement message alongside the tag Nofawkx‑al and is described in the article as a collection of Albanian hackers. The group’s known location is Albania, and they are identified by the signature phrase they left on the compromised pages. Their activity is limited to the observed website defacements, with no additional aliases publicly confirmed beyond those seen in the message.

The actors defaced two official South Yorkshire Police websites in the United Kingdom, replacing the home pages with their own content. The targeted sector is law‑enforcement/government and the geographic focus is the United Kingdom. The article states that the reason for the attack was unknown and characterizes the incident as a random defacement, indicating a disruption‑oriented goal rather than financial profit or espionage. No data exfiltration, ransom demand, or monetary gain was reported. The police’s official Twitter account confirmed the compromise and later announced restoration of the sites, and the article provides links to Zone‑h mirrors of the defaced pages.

The observed technique consisted of a straightforward web‑site defacement in which the legitimate homepage was swapped for a custom page bearing a textual statement and a video message. The message includes references to Illyrian heritage, red and black clothing, an eagle, and a pledge to die for the flag, but no malware, exploit kit, or specific initial‑access method is mentioned in the source. Attribution rests on the self‑declared Albanian origin and the alias used in the defacement, with no public evidence linking the group to a state sponsor or a criminal consortium. The only operation explicitly tied to Kkuq e zi in the provided material is the June 2016 South Yorkshire Police website defacement. The article also notes that UK police websites have been targeted before, citing the Hertfordshire Police breach associated with OpFreeAssange, but treats that as a separate historical event.