Loading threat actor…
Anonymous is a decentralized hacktivist collective and open banner used by loosely affiliated participants rather than a single hierarchical organization. Emerging from imageboard and IRC culture in the late 2000s, it became widely known through campaigns such as Project Chanology against Scientology, Operation Payback in support of WikiLeaks, and later politically motivated operations tied to protest movements, anti-censorship causes, anti-police activism, and opposition to authoritarian governments. Common aliases include Anonymous Collective, Anonymous Hackers, and related branding used by supporters and splinter elements; LulzSec is a notable offshoot historically associated with the broader Anonymous milieu. Anonymous has conducted or claimed responsibility for a broad range of disruptive and intrusive activity, including distributed denial-of-service attacks, website defacements, unauthorized access, data theft and public leaking of stolen information, and propaganda-oriented operations intended to shape public attention. Documented targets have included payment processors, media organizations, political parties, law-enforcement entities, government institutions, extremist groups, and state broadcasters. Operations attributed to Anonymous or Anonymous-linked actors have targeted, among others, PayPal, Visa, MasterCard, HBGary Federal, the Republican Party of Texas, Ku Klux Klan infrastructure, Russian entities during #OpRussia, and Iranian state media under #OpIran. The collective has also been associated with large-scale disclosures such as BlueLeaks, which exposed data from numerous U.S. law-enforcement-related websites. The collective’s tactics blend technical intrusion with public messaging and symbolic action. Anonymous has historically used DDoS campaigns for disruption, defacements for political messaging, exfiltration and publication of internal data to embarrass or expose targets, and social amplification through videos, social media, and recognizable iconography such as the Guy Fawkes mask and the slogan “We are legion.” Its decentralized nature means attribution is often uneven: some operations are directly tied to known Anonymous participants, while others are merely claimed under the banner without independent confirmation. Law-enforcement actions against prominent participants, including figures linked to LulzSec and other Anonymous-associated cells, fragmented parts of the movement but did not eliminate the brand, which has repeatedly resurfaced during periods of political unrest. Anonymous is best characterized as a hacktivist ecosystem motivated primarily by ideology and publicity rather than financial gain. Its campaigns have centered on anti-censorship, transparency, protest support, retaliation against perceived abuses of power, and online mobilization around geopolitical events. Because anyone can invoke the Anonymous name, the collective encompasses a wide spectrum of capability, discipline, and intent, ranging from low-impact stunt operations to consequential intrusions and data leaks.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
36 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
46 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as a comparison point to Phineas Fisher in discussing hacktivism notoriety.
Mentioned as an example in a discussion of hacktivism and digital resistance movements.
Hacktivist collective discussed in the context of a documentary about motivation-driven cyber activity focused on visibility, disruption, embarrassment, pressure, and messaging rather than financial gain.
Mentioned as a rival hacktivist collective attacking ETA and doxing one of its members, prompting ETA's planned retaliation.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.