APT / THREAT GROUP✊ HACKTIVISM

GhostSec

aliases

Last seen:Mar 17, 2026

Intelligence Profile

GhostSec is a hacktivist group that emerged as an offshoot of Anonymous. They primarily focused on counterterrorism efforts and monitoring online activities associated with terrorism. They gained prominence following the 2015 Charlie Hebdo shooting in Paris and the rise of ISIS.

Threat Analysis

GhostSec is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of hacktivism.

As a hacktivist-aligned entity, GhostSec conducts operations driven by ideological, political, or social grievances, typically through website defacements, DDoS attacks, and the leaking of sensitive data to advance a public narrative.

External References

→https://www.uptycs.com/blog/ghostlocker-ransomware-ghostsec

→https://forescoutstage.wpengine.com/blog/the-increasing-threat-posed-by-hacktivist-attacks-an-analysis-of-targeted-organizations-devices-and-ttps/

Quick Facts

TypeAPT / Threat Group

Motivation✊ hacktivism

Aliases2

SourceMalpedia

Also Known As

GhostSecGhost Security

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search GhostSec