GlobalHell
Though this group is said to have disbanded in 1999, GlobalHell can be credited with being one of the first hacking groups who gained notoriety for website defacements and breaches. Stealing private and financial information, GlobalHell's founder has said the group caused $2.5 million in damages. GlobalHell infiltrated the White House, Ameritech, the United States army and the U.S. Postal Service.
TeaMp0isoN
Founded by a skilled 16-year-old hacker, TeaMp0isoN hacked into the English Defence League and NATO without breaking a sweat. Rumors swirled that the hacking group disbanded in 2012, but they came back in 2015 with a new image: a white-hat security research group.
Lizard Squad
Most widely known for their distributed denial-of-service (DDoS) attacks, Lizard Squad took down the Malaysian Airlines website and Facebook, though Facebook denies this. More recently, Lizard Squad puts their hacking efforts to disrupting social media services. You're your business conduct your client and customer service and reviews online? Prepare for war.
Iran’s Tarh
Andishan Tarh Andishan apparently wants to control the world’s web-based systems. The group is estimated to have 20 members mostly based in Tehran, Iran. A talented hacker group, Tarh Andishan apparently grew out of a Stuxnet worm virus Iran claimed the US and Israel created. The Iranian government doubled-down on its cyber warfare. The group uses self-propagating software, systems, backdoors, SQL injection, and other techniques. One of the attacks for which the group is best known is “Operation Cleaver.” This hacker group has apparently hacked airline gates and security systems.
The Level Seven Crew
This hacker group’s name is rumored to be inspired by the seventh level of hell from Dante’s Inferno, ‘the violent’ level. The group hacked 60 high profile computer systems (NASA, Sheraton Hotels, The First American national Bank) in 1999. They hacked into the US Embassy in China’s website. The group disbanded in 2000.
GlobalHell
Though this group is said to have disbanded in 1999, GlobalHell can be credited with being one of the first hacking groups who gained notoriety for website defacements and breaches. Stealing private and financial information, GlobalHell's founder has said the group caused $2.5 million in damages. GlobalHell infiltrated the White House, Ameritech, the United States army and the U.S. Postal Service.
TeaMp0isoN
Founded by a skilled 16-year-old hacker, TeaMp0isoN hacked into the English Defence League and NATO without breaking a sweat. Rumors swirled that the hacking group disbanded in 2012, but they came back in 2015 with a new image: a white-hat security research group.
Lizard Squad
Most widely known for their distributed denial-of-service (DDoS) attacks, Lizard Squad took down the Malaysian Airlines website and Facebook, though Facebook denies this. More recently, Lizard Squad puts their hacking efforts to disrupting social media services. You're your business conduct your client and customer service and reviews online? Prepare for war.
Iran’s Tarh
Andishan Tarh Andishan apparently wants to control the world’s web-based systems. The group is estimated to have 20 members mostly based in Tehran, Iran. A talented hacker group, Tarh Andishan apparently grew out of a Stuxnet worm virus Iran claimed the US and Israel created. The Iranian government doubled-down on its cyber warfare. The group uses self-propagating software, systems, backdoors, SQL injection, and other techniques. One of the attacks for which the group is best known is “Operation Cleaver.” This hacker group has apparently hacked airline gates and security systems.
The Level Seven Crew
This hacker group’s name is rumored to be inspired by the seventh level of hell from Dante’s Inferno, ‘the violent’ level. The group hacked 60 high profile computer systems (NASA, Sheraton Hotels, The First American national Bank) in 1999. They hacked into the US Embassy in China’s website. The group disbanded in 2000.
Cybercriminals are individuals or teams of people who use technology to commit malicious activities on digital systems or networks with the intention of stealing sensitive company information or personal data and generating profit.
Cybercriminals are known to access the cybercriminal underground markets found in the deep web to trade malicious goods and services, such as hacking tools and stolen data. Cybercriminal underground markets are known to specialize in certain products or services.
Hacking does not necessarily count as a cybercrime; as such, not all hackers are cybercriminals. Cybercriminals hack and infiltrate computer systems with malicious intent, while hackers only seek to find new and innovative ways to use a system, be it for good or bad.
Cybercriminals also differ greatly from threat actors in various ways, the first of which is intent. Threat actors are individuals who conduct targeted attacks, which actively pursue and compromise a target entity’s infrastructure. Cybercriminals are unlikely to focus on a single entity, but conduct operations on broad masses of victims defined only by similar platform types, online behavior, or programs used. Secondly, they differ in the way that they conduct their operations. Threat actors follow a six-step process, which includes researching targets and moving laterally inside a network. Cybercriminals, on the other hand, are unlikely to follow defined steps to get what they want from their victims. Note, however, that cybercriminals have also been known to adopt targeted attack methodologies in their operations.
Hacktivists generally believe they’re acting altruistically for the public good. Similar to activism in our physical world, online activists seek to bring public attention to a cause that’s important to them in hopes they’ll invoke change. This often means exposing and correcting perceived injustices.
The nature of the perceived injustices might be political, social, or religious:
- Politically motivated hacktivism seeks to promote or upheave a political agenda, sometimes to the extent of anarchy.
- Socially motivated hacktivism sets out to expose social injustices, ranging from government censorship to human rights.
- Religiously motivated hacktivism acts in the name of a religious ideology and may seek to discredit or encourage the belief.
Despite any altruistic intentions, hacktivism attacks are hacking attacks, which means they’re illegal. But they’re also difficult to prosecute because they’re mostly conducted anonymously.
Unlike traditional hacking attacks, though, hacktivism attacks rarely have true malicious intent. In some cases, you might think of them as a form of antagonism, such as the way we might see graffiti on billboards.
Still, just as this is vandalism in real life, website defacing is considered cyber vandalism. This is just one example of the types of hacktivism that exist today.
- Anonymous blogging
- RECAP
- Website defacement
- Website redirects
- Website mirroring
- Denial of Service (DoS) or Distributed Denial of Service attacks (DDoS)
- Virtual sit-ins
- Leaks
- Doxing
- Geo-bombing
-
Publicly available information helps foreign intelligence entities identify people with placement and access.
-
Contract information (bid, proposal, award, or strategies).
-
Company website with technical and program information.
-
Connections (partnerships, key suppliers, joint ventures, etc.) with other cleared or non-cleared companies.
-
Employee association with companies or technologies made public through scientific journals, academia, public speaking engagements, social networking sites, etc.
-
Company unclassified networks (internal and extranets), partner and community portals, and commonly accessed websites.
-
Proprietary information (business strategy, financial, human resource, email, and product data).
-
Export-controlled technology.
-
Administrative and user credentials (usernames, passwords, tokens, etc.).
-
Foreign intelligence entities seek the aggregate of unclassified or proprietary documents which could paint a classified picture.
Cyber Criminals (Organized Cybercriminals)
Cybercriminals are individuals or groups of people who use technology to commit cybercrime to steal sensitive company information or personal data and generate profits.
Hacktivists
Hacktivists are individuals or groups of hackers who carry out malicious activity to promote a political agenda, religious belief, or social ideology. Hacktivists are not like cybercriminals who hack computer networks to steal data for cash. They are individuals or groups of hackers who work together and see themselves as fighting injustice.
State-sponsored Attacker (APT Groups)
State-sponsored attackers have particular objectives aligned with either the political, commercial, or military interests of their country of origin. These types of attackers are not in a hurry. The government organizations have highly skilled hackers and specialize in detecting vulnerabilities and exploiting these before the holes are patched. It is very challenging to defeat these attackers due to the vast resources at their disposal.
Insider Threats
The insider threat is a threat to an organization's security or data that comes from within. These types of threats are usually occurred from employees or former employees, but may also arise from third parties, including contractors, temporary workers, employees, or customers.
Malicious Insider Threats
Malicious threats are attempts by an insider to access and potentially harm an organization's data, systems, or IT infrastructure. These insider threats are often attributed to dissatisfied employees or ex-employees who believe that the organization was doing something wrong with them in some way, and they feel justified in seeking revenge.
Cyber Terrorists
Terrorism, by its very nature, seeks out whatever means possible to proliferate fear, unrest, and discord across the globe. Cyber terrorists utilize an array of cyber weapons to disrupt critical services and commit harmful acts to further their cause. Generally speaking (though far from exclusively), they target the state operations, businesses, and critical services that will cause the most dramatic effect.
Individual users: This category focuses on individuals as victims. The threat actors steal and use stolen data, credit card numbers, online financial account information, or ss numbers.
Enterprises: This category of financial cybercrime focuses on enterprises and business org. Threat actors will attempt to steal research on a new product to sell it to another supplier which deprives the legitimate business of profits.
Governments: Governments are also the targets of threat actors. If military information can be stolen, it can be sold. Government information can also be stolen and published in front of its citizens to embarrass the government.
Hacktivists generally believe they’re acting altruistically for the public good. Similar to activism in our physical world, online activists seek to bring public attention to a cause that’s important to them in hopes they’ll invoke change. This often means exposing and correcting perceived injustices.
The nature of the perceived injustices might be political, social, or religious:
- Politically motivated hacktivism seeks to promote or upheave a political agenda, sometimes to the extent of anarchy.
- Socially motivated hacktivism sets out to expose social injustices, ranging from government censorship to human rights.
- Religiously motivated hacktivism acts in the name of a religious ideology and may seek to discredit or encourage the belief.
Despite any altruistic intentions, hacktivism attacks are hacking attacks, which means they’re illegal. But they’re also difficult to prosecute because they’re mostly conducted anonymously.
Unlike traditional hacking attacks, though, hacktivism attacks rarely have true malicious intent. In some cases, you might think of them as a form of antagonism, such as the way we might see graffiti on billboards.
Still, just as this is vandalism in real life, website defacing is considered cyber vandalism. This is just one example of the types of hacktivism that exist today.
- Anonymous blogging
- RECAP
- Website defacement
- Website redirects
- Website mirroring
- Denial of Service (DoS) or Distributed Denial of Service attacks (DDoS)
- Virtual sit-ins
- Leaks
- Doxing
- Geo-bombing
-
Publicly available information helps foreign intelligence entities identify people with placement and access.
-
Contract information (bid, proposal, award, or strategies).
-
Company website with technical and program information.
-
Connections (partnerships, key suppliers, joint ventures, etc.) with other cleared or non-cleared companies.
-
Employee association with companies or technologies made public through scientific journals, academia, public speaking engagements, social networking sites, etc.
-
Company unclassified networks (internal and extranets), partner and community portals, and commonly accessed websites.
-
Proprietary information (business strategy, financial, human resource, email, and product data).
-
Export-controlled technology.
-
Administrative and user credentials (usernames, passwords, tokens, etc.).
-
Foreign intelligence entities seek the aggregate of unclassified or proprietary documents which could paint a classified picture.
