Loading threat actor…
Alcasec is the alias of Spanish hacker José Luis Huertas, a criminal actor associated with intrusions against Spanish government systems and the theft and commercialization of sensitive personal data. He has been accused by Spanish authorities of participating in a private intelligence operation built around unlawfully obtained datasets, including large-scale citizen records. Reporting links him to access, storage, indexing, and monetization of stolen information through a dedicated cloud-based platform. Alcasec has been tied to the compromise of a Spanish government file-transfer system in 2022, an intrusion that resulted in the theft of taxpayer data affecting hundreds of thousands of individuals. More recent allegations connect him with associates including former Spanish interior ministry official Francisco Martínez in a scheme centered on exploiting stolen data for intelligence and commercial purposes. The activity attributed to Alcasec is consistent with financially motivated cybercrime focused on initial access to sensitive systems, data theft, post-compromise handling of stolen information, and monetization of exfiltrated records rather than espionage or disruptive operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.