GNAA is a notorious internet troll group known primarily for harassment, provocation, and disruptive online activity rather than sustained, sophisticated intrusion operations. It has been referenced in connection with Goatse Security, a loosely organized subdivision or affiliated vehicle used by some GNAA members to publish security research. Through that association, GNAA has been linked to the 2010 AT&T iPad data-exposure incident in which Goatse Security enumerated an openly accessible AT&T interface and collected large numbers of customer email addresses tied to iPad 3G accounts. Public reporting on that case identified Goatse Security members including Andrew "weev" Auernheimer and Daniel Spitler, and described the activity as controversial vulnerability disclosure centered on unauthorized data collection from an exposed API. GNAA has also been cited in disruptive publicity actions, including claiming responsibility for redirects from major companies’ Wikipedia pages to a press release targeting Bumble during a dispute involving the company’s use of residential property as office space. Available information supports characterizing GNAA as an online trolling and harassment collective with occasional association to opportunistic security-related activity through Goatse Security, rather than as a conventional financially motivated cybercrime gang, ransomware operator, or state-backed espionage actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An internet troll group that was enlisted to harass or pressure Bumble, including causing Wikipedia page redirects to a GNAA press release about evicting Bumble from its office.
GNAA appears only in a generic Wikipedia navigation list of hacking groups, without any discussion tying it to the PoisonIvy content.
Groups Anonymous associated events Avalanche Crime Boys GNAA Goatse Security Insanity Zine Corp. GhostNet Level Seven PLA Unit 61398 Prime Suspectz RBN ShadowCrew World of Hell Sandworm
Groups Anonymous associated events Avalanche Crime Boys GNAA Goatse Security Insanity Zine Corp. GhostNet Level Seven PLA Unit 61398 Prime Suspectz RBN ShadowCrew World of Hell Sandworm
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.