Anonymous
Anonymous is a decentralized hacktivist collective and open banner originating from 4chan-era anonymous internet culture. The content describes it as a loose confederation active since at least 2008, with no centralized leadership, and notes that anyone can claim the Anonymous banner. Known associated aliases and sub-groups directly mentioned in the content include LulzSec/Lulz Security, Anonymous Hispano, and the PayPal 14; prominent associated figures mentioned include Aubrey Cottle, Hector "Sabu" Monsegur, Jeremy Hammond, and the persona "Kayla" later linked by police to Ryan Ackroyd. The content attributes to Anonymous a long history of politically motivated hacktivism, including Project Chanology against the Church of Scientology; Operation Payback / Operation Avenge Assange targeting PayPal, Visa, MasterCard, and others after WikiLeaks donation restrictions; attacks and leaks involving HBGary Federal; support activity around Tunisia, Occupy, Ferguson, and anti-KKK operations; Operation Turkey protesting internet censorship; and later campaigns against Islamic State, QAnon, Russia (#OpRussia), and Killnet. The group is also linked in the content to the BlueLeaks disclosure, described as 269 GB of law-enforcement data allegedly stolen from 251 law-enforcement-related websites and published by DDoSecrets. Tactics directly mentioned in the content include distributed denial-of-service attacks, website defacements, data theft and public leaks, exposure of internal emails and documents, attacks on chat infrastructure, and publication of personal details. Specific examples mentioned include DDoS attacks against PayPal, Visa, MasterCard, the RIAA, and foreign government systems; defacement of the PRI-DF website in Mexico City; compromise of HBGary Federal resulting in publication of more than 50,000 emails; attacks on Ku Klux Klan infrastructure and release of member details; and anti-Russian targeting of Russian state, financial, and media entities during the Russia-Ukraine conflict. The content also emphasizes that Anonymous has been the target of state disruption efforts. Leaked Snowden archive reporting cited in the content says GCHQ's JTRIG monitored and targeted Anonymous, including with DDoS attacks against IRC chatrooms used by Anonymous and LulzSec members. Overall, the content portrays Anonymous as a persistent, decentralized hacktivist movement focused on anti-censorship, transparency, protest, and politically charged cyber operations, but also one whose actions have included unlawful intrusions, disruptive attacks, leaks, and occasional misidentification of targets.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Tradecraft
34 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
40 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist group linked in the content to a cyberattack targeting the Texas Republican Party.
Discussed as a notable hacking group that shaped hacking culture and cybercrime subculture.
Hacktivist activity involving website defacement of Hungarian government-affiliated news sites, including Mediaworks outlets.
Claimed responsibility for hacking the Republican Party of Texas, conducting a website defacement and subsequent data and document leak.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.