Cyber Incident Victim: Anonymous
Date:
Sep 2015
Location:
United States of America
Summary
An unidentified hacker using the alias "sgtbilko420" conducted distributed denial-of-service (DDoS) attacks against multiple racist groups and websites, including affiliates of the KKK, the Westboro Baptist Church, an Islamic State-linked platform, and a former Canadian prime minister's site, temporarily disrupting their online operations. The perpetrator claimed the actions aimed to combat racism, announcing plans to escalate attacks around Halloween while offering a financial reward for anyone who could reveal their identity. Despite threats and takedown efforts, the individual operated independently without formal ties to established hacker collectives and remained anonymous after targeting approximately 20 sites over several weeks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Beginning on September 15, 2015, an individual using the alias "sgtbilko420" initiated a series of distributed denial-of-service (DDoS) attacks against websites associated with racist ideologies and organizations. The attacker publicly claimed responsibility via a Twitter account (@sgtbilko420), explicitly targeting entities including Ku Klux Klan affiliates, online stores selling racist merchandise, the Westboro Baptist Church, a website linked to Islamic State, and a site associated with former Canadian Prime Minister Stephen Harper. Twenty websites were rendered inaccessible during these attacks, which overwhelmed targets with traffic from compromised computer networks. The hacker justified their actions through social media statements condemning racism, declaring "it was time for all racism to come to an end [...] this is not the 1800s anymore." Tactical announcements preceded operational escalations, with a October 21 tweet taunting targets about their vulnerability to a single attacker.
Despite successful temporary takedowns, several affected websites restored functionality during the campaign. The attacker maintained operational tempo, publicly threatening expanded actions against twenty additional racist sites scheduled for Halloween. A $5,000 bounty was offered for anyone capable of revealing the hacker's real identity through doxing, though no successful identification occurred despite attempted countermeasures. All documented attacks exclusively utilized DDoS methodology without evidence of data breaches or permanent infrastructure damage. The actor operated independently without claiming affiliation to Anonymous or established hacktivist collectives, sustaining attacks through at least late October 2015 based on declared intentions. No law enforcement responses or technical countermeasures were detailed in available reporting regarding containment efforts against the ongoing campaign.