Loading threat actor…
JTRIG, short for Joint Threat Research Intelligence Group, is a covert operational unit within the United Kingdom’s Government Communications Headquarters (GCHQ). Public reporting based on leaked intelligence documents has associated the unit with online influence, deception, disruption, and cyber-enabled covert action rather than conventional espionage collection alone. JTRIG has been linked to operations intended to shape online behavior, discredit targets, manipulate discourse, and produce real-world or cyber effects through information operations and computer network attack. Reported JTRIG tradecraft includes the use of false personas, honeypots, false-flag activity, spoofed communications, reputation-destruction campaigns, social engineering, and coordinated messaging across online platforms. Leaked materials have also associated the unit with denial-of-service operations, deanonymization efforts, monitoring of online communications, and tools for amplifying or suppressing online content. Additional reported capabilities include manipulating online polls and traffic metrics, sending mass messages for influence operations, and using behavioral science and psychological methods to assess whether messaging was understood, accepted, remembered, and acted upon. Targets reportedly included hacktivist communities such as Anonymous and LulzSec, as well as online activists, suspected criminals, and foreign political audiences. JTRIG has also been linked to influence activity related to the 2009 Iranian protest movement and the 2011 Syrian uprising, including efforts framed as counter-censorship, online human intelligence collection, and strategic influence and disruption. Sub-elements referenced in leaked materials include a Human Science Operations Cell and teams focused on global targets, including Iran. JTRIG is widely characterized as a British state intelligence capability focused on covert online manipulation, disruption, and operational support to broader national security objectives.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducted covert online influence, infiltration, deanonymization, and disruption operations against hacktivists and Middle East protest movements, including use of honeypots, sockpuppet personas, tracking links, and censorship-bypass infrastructure for intelligence collection and manipulation.
Conducting covert online influence, deception, surveillance, account disruption, spoofing, and denial-of-service operations, including manipulation of polls, amplification of messages on YouTube, content disruption, Skype monitoring, and false-flag style activities.
Conducting online covert operations focused on influence, disruption, deception, reputation destruction, infiltration of online communities, and manipulation of online discourse, including operations against Anonymous and hacktivists.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.