Cyber Incident Victim: WauchulaGhost
Date:
Apr 2017
Location:
United States of America
Summary
A hacktivist known as WauchulaGhost compromised approximately 250 Twitter accounts linked to ISIS, replacing their content with adult material—particularly gay pornography—to provoke the terrorist group. This followed prior breaches of around 500 jihadist accounts using similar tactics, during which he obtained personal information including phone numbers and IP addresses. In a related campaign after the Orlando nightclub shooting, he substituted pro-ISIS imagery with LGBTQ+ messages, triggering graphic death threats from supporters who sent violent imagery and beheading warnings. Despite these threats, the hacktivist continued his activities targeting extremist accounts for nearly two years.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around April 25, 2017, a hacktivist operating under the alias WauchulaGhost compromised approximately 250 Twitter accounts affiliated with the Islamic State (ISIS). The attacker replaced pro-ISIS content with adult material, specifically gay pornography, intending to provoke and disrupt terrorist propaganda channels. This operation followed established patterns from WauchulaGhost’s prior activities, including a 2016 breach of roughly 500 ISIS-linked accounts where similar adult content was deployed. During the 2017 incident, the hacktivist exfiltrated comprehensive account data, including associated phone numbers, IP addresses, and other identifying information from the compromised profiles. WauchulaGhost publicly justified the tactic by asserting that pornography and depictions of women represented cultural taboos strategically effective against ISIS’s ideological framework.
The 2017 campaign extended WauchulaGhost’s multi-year targeting of jihadist social media presence, which included a notable operation following the June 2016 Orlando nightclub shooting. In that earlier incident, the hacker had defaced ISIS supporter accounts by replacing extremist imagery with pro-LGBTQ+ messages. These actions consistently triggered hostile responses from ISIS affiliates, including direct death threats sent via Twitter direct messages. Threats featured graphic imagery such as beheading simulations, though no physical harm to WauchulaGhost was documented in available reports. Despite sustained intimidation efforts spanning nearly two years of anti-ISIS operations, the hacktivist maintained public activity with no indication of operational cessation following the April 2017 account takeovers. The repeated use of adult content and LGBTQ+-themed substitutions demonstrated a consistent methodology aimed at exploiting perceived cultural vulnerabilities within the terrorist organization.