Loading threat actor…
Guccifer is the alias of Romanian hacker Marcel Lehel Lazar, a lone-actor intruder known for compromising the email and social media accounts of prominent public figures and then publicly disclosing stolen private material. His activity, documented from late 2012 through early 2014, focused on high-profile U.S. political and public personalities, including associates and relatives of former presidents and senior government officials. Public reporting and U.S. criminal charges tie him to intrusions involving Sidney Blumenthal and members of the Bush family, as well as other notable victims. Guccifer’s operations relied on comparatively simple but effective account-compromise tradecraft rather than advanced malware or enterprise intrusion techniques. He was associated with targeting personal webmail and social-media accounts, researching victims and their associates, abusing weak password-reset and security-question mechanisms, and using compromised accounts to impersonate victims and expose sensitive correspondence, personal photographs, and medical and financial information. Reporting also links him to the use of proxy infrastructure for anonymity. Claims that he directly breached Hillary Clinton’s private server were publicly made by Lazar himself but were not independently verified; high-confidence attribution supports his compromise of Sidney Blumenthal’s account and the subsequent disclosure of communications involving Clinton, not a confirmed server intrusion. Guccifer is best characterized as an opportunistic, publicity-seeking actor whose activity centered on unauthorized access, credential abuse, impersonation, and information disclosure against politically exposed individuals. Available evidence supports Romania as his operating base and indicates a primary focus on U.S. victims in the political and governmental sphere.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Compromised Sidney Blumenthal's AOL account and allegedly used it as a stepping stone to access Hillary Clinton's personal email server, using email header analysis, IP scanning, and proxy infrastructure.
Compromised Sidney Blumenthal’s AOL email account and exposed emails sent to Hillary Clinton’s private account.
Compromised email and social media accounts of high-profile victims, impersonated at least one victim, and publicly leaked stolen private correspondence, financial and medical information, and personal photos.
Compromised public webmail accounts of associates of high-profile political figures and leaked stolen personal and sensitive communications.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.