Hacktivist.

Hacktivists publicise their grievances through defacements, leaks of sensitive documents ("hack and leak"), DDoS, doxxing, and disruption of services they consider unjust. Some are loosely organised online collectives such as Anonymous, LulzSec, GhostSec, or Anonymous Sudan; others align with geopolitical conflicts, such as the IT Army of Ukraine, Killnet, NoName057(16), and Cyber Av3ngers. Capabilities range from basic DDoS-as-a-service to credential leaks of millions of records.

Two shifts have made modern hacktivism more consequential than the defacement era. First, it now reaches operational technology: in November 2023 the Iran-aligned "Cyber Av3ngers" persona compromised internet-exposed Unitronics PLCs at the Municipal Water Authority of Aliquippa, Pennsylvania, by simply using the default password 1111, forcing a booster station offline. CISA and the FBI issued joint advisory AA23-335A in response. Second, the line with statecraft has blurred — "Anonymous Sudan," presented as an ideological collective, was later assessed by researchers and named in a 2024 U.S. indictment as an operation run by Sudanese nationals wielding a rented DDoS botnet, illustrating how a hacktivist banner can mask criminal or state-aligned actors.

This deniability is the core policy problem: because hacktivism frequently overlaps with nation-state operations through proxies or shared ideology, defenders should treat a hacktivist claim as a starting hypothesis, not a conclusion, and prioritise the same hardening — no default credentials, no internet-exposed OT, DDoS mitigation — regardless of who is claiming the attack.

flowchart TD
  M["Ideological / political grievance"] --> ACT{"Tactic"}
  ACT --> D["Website defacement"]
  ACT --> L["Hack-and-leak / doxxing"]
  ACT --> DD["DDoS campaign"]
  ACT --> OT["OT / ICS disruption"]
  OT --> EX["Cyber Av3ngers vs<br/>Unitronics PLC, default pw 1111"]
  D --> PUB["Public attention / pressure"]
  L --> PUB
  DD --> PUB
  EX --> PUB
  PUB --> ATTR["Attribution challenge:<br/>proxy for nation-state?"]