What Is Hacktivism?

An Expert's Perspective

To better understand hacktivism, we spoke with Raluca Saceanu. Raluca is the CEO of Smarttech247, an enterprise cyber security organization and Splunk partner. She holds a Master of Science in Strategic Management from the University of Innsbruck and received the Women in Technology Advocate Award by Deloitte in 2021.

In this section, we've included Raluca's responses to our prompts.

The Rise of Hacktivism

In recent years, hacktivism has surged to prominence, blending the worlds of hacking and activism to advance political and social causes through technology. This convergence has had significant implications for the cybersecurity industry, which now faces the dual challenge of protecting clients from cyberattacks while understanding the motivations behind these digital protests. Anonymous, the most famous hacktivist group, emerged from the online message board 4chan in the early 2000s. Known for its decentralised structure and the iconic Guy Fawkes mask, Anonymous champions internet freedom, transparency, and anti-censorship. Despite its impactful campaigns, Anonymous's lack of clear leadership makes its actions unpredictable, which is the case for many hacktivist groups. This unpredictability underscores the importance for the cybersecurity industry to understand such groups in order to develop effective defence strategies against hacktivist threats.

The Convergence of Hacktivism and Cyber Warfare

As hacktivist activities become more sophisticated, they often blur the lines with cyber warfare, where state-sponsored groups or politically motivated hackers target nations' critical infrastructure. This intersection of hacktivism and cyber warfare underscores the growing threat of politically driven cyber attacks that aim to destabilise governments, disrupt economies, and sow societal discord. By exposing sensitive information or disrupting critical systems, they aim to weaken the target's position and create a favourable environment for their own strategic interests. Such attacks are particularly potent in the context of international conflicts and political rivalries, where cyber warfare can be a tool for asymmetrical engagement.

Since the onset of the Russia-Ukraine conflict in 2022, both state-sponsored hackers and independent hacktivist groups have launched numerous cyber attacks. Such attacks aim to undermine the enemy's infrastructure, sow chaos, and erode public morale. By targeting essential services like the power grid, hackers can create significant disruption and psychological impact, highlighting the strategic value of cyber warfare in modern conflicts.

Common types of hacktivist attack methods and motivations:

1. Distributed Denial of Service (DDoS) Attacks

   In the context of hacktivism, a DDoS attack involves flooding a target's server with an overwhelming amount of traffic to render it inaccessible. This tactic is used to disrupt the normal operations of a website or online service, effectively silencing or punishing the target. Hacktivists opt for DDoS attacks because they are relatively easy to execute and can cause significant disruption without requiring deep technical expertise. The attacks draw attention to the hacktivists' cause by making a public and noticeable impact. By temporarily shutting down websites of government agencies, corporations, or other organisations, hacktivists can protest against perceived injustices and attract media coverage. In 2023, hacktivist groups claimed responsibility for over 1,800 DDoS attacks within a two-month period, as tracked by the Radware Threat Intelligence team. These attacks targeted a variety of countries, with the most frequent targets being Israel, India, and Australia. This surge in activity underscores the significant role hacktivism continues to play in the global cyber threat landscape.
   
   One of the most famous instances of DDoS Operation Payback, orchestrated by the hacktivist group Anonymous in 2010, involved a series of DDoS attacks targeting organisations perceived to oppose internet freedom. Notable targets included the Recording Industry Association of America (RIAA) and the Motion Picture Association of America (MPAA). Anonymous initiated Operation Payback in response to these organisations' efforts to shut down file-sharing websites. By overwhelming the targets' servers with traffic, Anonymous aimed to disrupt their operations and draw public attention to what they viewed as a corporate overreach against digital rights. The underlying message was clear: attempts to control and censor the internet would be met with swift and disruptive resistance.
   
   A recent example of a DDoS attack employed by hacktivists is the campaign by the pro-Russian group KillNet targeting the U.S. healthcare sector. In January 2023, KillNet launched a series of DDoS attacks against healthcare organisations, significantly disrupting their services. These attacks involved overwhelming the target servers with traffic to render them inaccessible, affecting hospitals, healthcare providers, and related entities. The aim was to retaliate against Western support for Ukraine amid the ongoing conflict.

2. Data Breaches and Leaks

   Data breaches and leaks involve unauthorised access to confidential or sensitive information, which is then released to the public. Hacktivists use this tactic to expose unethical practices, corruption, or illegal activities within organisations or governments. Hacktivists opt for data breaches and leaks because these actions can have profound consequences. A good example is the Ashley Madison breach, for example, aimed to expose what the hackers deemed unethical behaviour and to highlight the lack of security protecting user privacy. By releasing such sensitive information, hacktivists sought to hold both the company and its users accountable, promoting a debate on the morality of the services offered and the importance of digital privacy.
   
   A recent example of a hacktivist attack that led to significant data loss and exposure involves the hacktivist group SiegedSec. In 2023, SiegedSec claimed responsibility for breaching NATO's Communities of Interest Cooperation Portal. This breach resulted in the leak of 8,000 personnel records containing details such as names, companies, job titles, business email addresses, home addresses, and photos, alongside various unclassified documents. The group stated that their actions were in retaliation for NATO's perceived attacks on human rights.

3. Ransomware

   In recent years, hacktivists have increasingly turned to ransomware as a tool to further their political and social agendas. Traditionally known for DDoS attacks, website defacements, and data leaks, groups like the Ikaruz Red Team and the Ukrainian Cyber Alliance have now adopted ransomware tactics. These groups use ransomware not primarily for financial gain but to disrupt operations, draw attention to their causes, and retaliate against their adversaries.
   
   Throughout 2023, IRT launched several ransomware attacks using modified versions of LockBit 3.0 against various entities in the Philippines. These attacks were not primarily financially motivated but aimed at sowing disruption and drawing attention to their political causes. The group publicly announced its attacks on social media, emphasising their intention to disrupt rather than profit. Another notable instance is the Ukrainian Cyber Alliance's attack on the Trigona ransomware group in October 2023. This hacktivist group managed to exfiltrate and wipe out the servers of Trigona, effectively disabling their operations. The hacktivists claimed this action was part of their ongoing efforts to disrupt Russian criminal enterprises.

The Increasing Rate and Future of Hacktivism

The effects of hacktivism driven by various motives—political, social, or geopolitical—extend far beyond the immediate targets, influencing the wider threat landscape significantly.

When Anonymous launched a series of DDoS attacks against entities like the RIAA and MPAA, the ripple effects of this digital assault were felt far and wide. Organisations worldwide scrambled to strengthen their defences, investing heavily in DDoS mitigation technologies. The attack also exposed the fragility of shared internet infrastructure, where collateral damage to untargeted sites became a harsh reality. The incident prompted regulatory bodies to tighten cybersecurity regulations, transforming the digital security landscape.

When the 2015 Ashley Madison breach orchestrated by The Impact Team took place, it had profound repercussions. By leaking the personal information of millions of users, the hacktivists aimed to expose what they deemed unethical behaviour. The fallout was swift and severe, as individuals faced personal and professional ruin. This breach underscored the critical need for robust data privacy, pushing organisations to adopt stronger encryption methods and spurring regulatory bodies to enact stringent data protection laws like the GDPR. Simultaneously, the global rise in cyber insurance highlighted a growing recognition of the financial risks posed by data breaches. These stories, along with many others like the geopolitical cyber attacks in the Russia-Ukraine conflict, illustrate how hacktivism is reshaping the cybersecurity landscape, compelling us all to reconsider how we protect our digital lives.