Loading threat actor…
GNAA is described in the provided content as a notorious, deliberately offensive internet troll group. The content links Goatse Security to GNAA, with Goatse Security described as a loosely organized subdivision of GNAA and as a vehicle for GNAA members to publish security research. In reporting on the 2010 AT&T iPad email exposure incident, Goatse Security was said to have identified an AT&T API that returned customer email addresses when queried with iPad hardware identifiers, enumerated more than 100,000 addresses, and disclosed the issue through Gawker/Valleywag after attempting to contact AT&T. A spokesperson quoted in the content denied that Goatse Security or GNAA engaged in website defacements or DDoS attacks. Separately, the content states that GNAA was involved in online harassment related to Bumble, where a former resident enlisted a friend in GNAA and the group claimed responsibility for redirects from major companies’ Wikipedia pages to a GNAA press release about Bumble’s eviction. No nation-state affiliation is indicated in the provided content. Known related subgroup/alias mentioned in the content: Goatse Security.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An internet troll group that was enlisted to harass or pressure Bumble, including causing Wikipedia page redirects to a GNAA press release about evicting Bumble from its office.
GNAA appears only in a generic Wikipedia navigation list of hacking groups, without any discussion tying it to the PoisonIvy content.
Groups Anonymous associated events Avalanche Crime Boys GNAA Goatse Security Insanity Zine Corp. GhostNet Level Seven PLA Unit 61398 Prime Suspectz RBN ShadowCrew World of Hell Sandworm
Groups Anonymous associated events Avalanche Crime Boys GNAA Goatse Security Insanity Zine Corp. GhostNet Level Seven PLA Unit 61398 Prime Suspectz RBN ShadowCrew World of Hell Sandworm
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.