Loading threat actor…
Ghost Security Group, commonly known as GhostSec, is a hacktivist collective associated with current and former Anonymous participants. It became widely known for anti-Islamic State operations conducted under the broader #OpISIS campaign, where it focused on disrupting extremist propaganda, recruitment, communications, and online support infrastructure. GhostSec has been described as an elite anti-ISIS cadre within the wider Anonymous-aligned ecosystem and later sought to professionalize its image and distance itself somewhat from the broader Anonymous brand. GhostSec’s activity has centered on identifying and disrupting online extremist infrastructure through volunteer tip intake, target vetting, platform reporting, host-abuse notification, and direct offensive actions. Reported methods include mass identification and reporting of extremist social-media accounts, website takedowns, distributed denial-of-service attacks, SQL injection, and infiltration of jihadi forums for intelligence collection. The group reportedly reviewed suspected targets through multi-person validation, including Arabic-language review, before acting. It also collected open-source and forum-derived intelligence on suspected Islamic State cyber operatives and passed some leads through intermediaries to U.S. intelligence and law-enforcement contacts. The group’s known targeting has primarily involved Islamic State-linked online assets and support networks rather than conventional commercial victimology. Its operations aimed to reduce the reach and resilience of extremist media and recruitment channels. GhostSec has also been mentioned as part of a later alliance of hacking groups known as the Five Families, alongside SiegedSec, BlackForums, ThreatSec, and Stormous Ransomware, but the supplied facts do not establish GhostSec itself as a ransomware actor. Known aliases include Ghost Security Group, Ghost Security, and GhostSec. High-confidence reporting supports characterization of the group as hacktivist and counter-extremist in orientation, with capabilities spanning reconnaissance, scanning, disruption, intelligence gathering, and data collection in support of online counterterrorism efforts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Member of the 'Five Families' alliance with SiegedSec and other groups, which collectively claimed multiple breaches before becoming inactive.
Anti-Islamic State hacktivist group conducting website takedowns, DDoS and SQL injection attacks, deep-web monitoring, forum infiltration, and intelligence sharing with U.S. authorities.
Anti-Islamic State hacktivist group conducting website takedowns, DDoS and SQL injection attacks, deep-web monitoring, forum infiltration, and intelligence gathering on suspected Islamic State infrastructure and supporters.
Groups Ghost Security
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.