Threatsec
ThreatSec is a hacktivist threat actor referenced in reporting around the October 2023 Israel-Hamas conflict and later hacktivist alliances. It was reported to have claimed a breach of Alfanet, described as Palestine’s largest ISP provider, and to have shut down its servers on 2023-10-08; available reporting noted that technical details of the incident had not been shared. ThreatSec was also identified as associated with KittenSec, which confirmed links to both SiegedSec and ThreatSec while claiming operations against government and private-sector targets across multiple NATO-aligned countries. In August 2023, ThreatSec was reported as a member of an alliance of hacking groups consisting of SiegedSec, Ghost Security, BlackForums, ThreatSec, and Stormous Ransomware, referred to as the “Five Families.” The provided content supports describing ThreatSec as a hacktivist operation; no high-confidence attribution to a nation-state is established in the source material.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Member of the 'Five Families' alliance with SiegedSec and other groups, which collectively claimed multiple breaches before becoming inactive.
Hacktivist group claiming to have breached and shut down a major Palestinian ISP provider.
Pro-Israeli hacktivist activity; reportedly conducted a destructive intrusion against Palestinian ISP Alfanet, shutting down servers.
Referenced as an associated hacktivist operation linked by KittenSec in the context of planned targeting of additional NATO countries.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.