Milw0rm
Milw0rm is a hacking group referenced in content about 1990s-era hacking groups and in reporting on politically motivated website defacements in 1998. The content links the group to a British hacker known as JF and states that a protest webpage used in a mass defacement of more than 300 websites bore the Milw0rm logo. In that incident, the attackers replaced homepages with a mushroom cloud image and an anti-nuclear declaration after exploiting weaknesses in EasySpace hosting infrastructure. The reporting characterized the activity as politically motivated anti-nuclear hacking rather than security research. The content also states that Milw0rm had previously claimed responsibility for stealing email and deleting web servers at the Bhabha Atomic Research Centre in Bombay, India, in the context of India-Pakistan nuclear tensions. The group is also listed in a Wikipedia navigational template of hacking groups associated with the 1990s. No nation-state attribution is provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a named hacking group in the historical timeline/navigation content.
Named hacking group listed in the content's 1990s timeline/navigation material.
Named as a hacking group in a 1990s hacking timeline/sidebar; no specific operations, malware use, or targeting details are provided in the content.
Hacktivist group tied to JF that conducted anti-nuclear politically motivated intrusions, including mass website defacements and attacks on India's atomic research center.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.