Loading story…
LulzSec carried out a short but highly visible campaign of intrusions and disruption against media, government, law-enforcement, and gaming targets, including PBS, Sony Pictures, the U.S. Senate, InfraGard, the CIA website, and the UK's SOCA. The group used website defacements, data theft, credential leaks, SQL injection, and distributed denial-of-service attacks, while amplifying its notoriety through Twitter, leaked data dumps, a public call-in line for target suggestions, and the broader AntiSec push alongside Anonymous. One early operation followed PBS reporting on WikiLeaks, and later leaked chat logs portrayed LulzSec as a small, publicity-driven but operationally cautious crew led by Sabu, with members such as Topiary and Kayla, amid internal strain and growing fear of retaliation.
Law-enforcement pressure quickly escalated on both sides of the Atlantic. British police arrested and charged Ryan Cleary over alleged botnet and DDoS activity tied to attacks including SOCA, though LulzSec denied he was a core member, and later cases identified Jake Davis, Ryan Ackroyd, and others as participants or associates. In the U.S., authorities revealed that LulzSec leader Hector Xavier Monsegur (Sabu) had become an FBI informant after his arrest, helping investigators prevent hundreds of attacks and identify co-conspirators. The group announced it was disbanding after roughly 50 days, but prosecutions continued: multiple suspects were arrested in coordinated international operations, two British members later pleaded guilty, and subsequent court filings tied the campaign to substantial financial and operational damage across numerous victims.
TTPs, infrastructure, and targeting history in one profile.
21 events from the most recent confirmed update back to the earliest known activity.
After cooperating with investigators, Hector Xavier Monsegur was sentenced in New York and left court a free man.
Court documents said Hector Xavier Monsegur, known as 'Sabu,' provided extensive post-arrest cooperation to the FBI that helped prevent roughly 300 cyberattacks and supported multiple prosecutions.
Reporting in April 2013 said LulzSec hacktivists pleaded guilty to cyberattacks affecting organizations including the NHS, Sony, and News International.
Ryan Cleary and Jake Davis pleaded guilty in London to conspiring with LulzSec members to attack government, media, and law-enforcement websites.
Authorities announced charges against five men in the U.K., Ireland, New York, and Chicago for hacking-related offenses tied to LulzSec, while reporting said alleged leader Hector Xavier Monsegur had already pleaded guilty.
Authorities in the United Kingdom, United States, and the Netherlands carried out coordinated arrests and searches targeting suspected members or associates of LulzSec and Anonymous.
The Metropolitan Police arrested two men in a coordinated international investigation into attacks attributed to LulzSec and Anonymous, saying the suspects were linked to offenses associated with the online identity 'Kayla.'
A teenager from Shetland was charged in connection with computer hacking allegations tied to the LulzSec investigation.
FBI agents searched the Hamilton, Ohio home of a teenager suspected of being LulzSec member 'm_nerva,' though no charges were filed at that time.
A teenager accused of attacking the SOCA website in the LulzSec investigation was released on conditional bail in the UK.
LulzSec said it was ending operations after a 50-day run of high-profile attacks, citing its farewell in a final release that also encouraged support for Anonymous and AntiSec.
Reporting on June 24 said LulzSec publicly denied responsibility for retaliatory attacks on The Sun and The Times websites following Ryan Cleary's arrest and charging.
British authorities charged Ryan Cleary with offenses tied to distributed denial-of-service attacks, including one connected to the Serious Organised Crime Agency website, while investigators examined seized equipment for broader links.
After a Pastebin post claimed LulzSec had obtained 2011 UK census records, the group publicly denied responsibility and warned that fake releases should not be trusted unless confirmed through its Twitter account.
British police arrested 19-year-old Ryan Cleary at his home in Wickford, Essex, in an investigation linked to attacks believed tied to LulzSec, with assistance from the FBI.
LulzSec said it had knocked the CIA website offline in a denial-of-service attack, and the CIA stated that it was investigating the incident.
LulzSec publicized a call-in number on Twitter to solicit target suggestions from the public as part of its campaign activity, claiming to receive thousands of calls and voicemails.
Leaked logs published in early June linked LulzSec participants to Anonymous-associated channels and showed internal discussions about operational security, media strategy, and ongoing attacks.
LulzSec targeted an FBI-affiliated InfraGard website, an intrusion later cited in reporting and leaked chat logs as a significant escalation that increased internal concern about law-enforcement attention.
In interviews following the PBS intrusion, LulzSec said it attacked the broadcaster for what it viewed as unfair treatment of WikiLeaks and framed the operation as done for 'lulz and justice.'
LulzSec compromised PBS.org after the broadcaster aired a critical WikiLeaks documentary and defaced the site with a false report claiming Tupac Shakur was alive in New Zealand.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
34 references tracked. Mallory keeps watching after this page renders.
pcmag.com
Open sourcetheguardian.com
Open sourcetheguardian.com
Open sourcetheguardian.com
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourcepastebin.com
Open sourceforbes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI escalated its investigation into **LulzSec** and affiliated **Anonymous** hackers by seizing server racks from a Reston, Virginia data center used by Swiss host DigitalOne, knocking multiple unrelated websites and services offline. According to reporting, agents were pursuing one customer but removed three equipment enclosures that may have held systems for many other clients, disrupting sites including **Curbed Network**, **Instapaper**, and **Pinboard** even though they were not identified as targets. U.S. officials said the operation was part of an active, broader inquiry supported by other agencies and international cybercrime partners. The enforcement push widened with arrests and searches tied to suspected members on both sides of the Atlantic. British authorities arrested a teenager on suspicion of hacking, while reports also described the arrest in London of a leading LulzSec figure and FBI raids on homes of suspected Anonymous participants in the United States, including a search in Hamilton, Ohio linked to the online alias `m_nerva`. Reporting said investigators drew on evidence connected to Ryan Cleary, who was charged under the UK Computer Misuse Act, as authorities worked to identify participants in the group after a string of high-profile intrusions and internal leaks exposed tensions inside LulzSec.
Jun 29, 2026
Lizard Squad carried out a series of high-profile attacks against gaming platforms, knocking **Sony's PlayStation Network** and **Microsoft's Xbox Live** offline during major periods of user activity and extending outages that left players unable to access online services. The group was also linked to attacks on other gaming infrastructure, including **Sony Online Entertainment** and **Blizzard Battle.net**, using disruptive tactics that drew broad public attention and affected millions of users. The campaign escalated beyond service disruption when the group posted a bomb threat on social media targeting a flight carrying Sony Online Entertainment president **John Smedley**, prompting **American Airlines** to divert the plane and bringing in an **FBI** response. Subsequent reporting said authorities arrested another alleged member while the group's own **Lizard Lair** service was hacked, underscoring mounting law-enforcement pressure and retaliation as the group's attacks and harassment tactics intensified.
Jun 29, 2026
The Scattered Lapsus$ Hunters (SLSH), a cybercrime collective formed from members of Scattered Spider, Lapsus$, and ShinyHunters, announced a temporary retreat from online activity after the FBI seized their clearweb site. The group, known for its Western and English-speaking membership, issued a series of aggressive messages on Telegram, vowing to retaliate against the FBI and promising a return in 2026. This announcement followed a period of heightened law enforcement scrutiny, including the arrest and charging of two teenagers in the UK for their alleged involvement in attacks attributed to Scattered Spider, a component of SLSH. The group has a history of dramatic exits and returns, having previously declared a hiatus only to reappear days later. SLSH has gained notoriety for targeting large organizations and for the scale of its operations. In parallel with their public threats, the group claimed responsibility for a massive data breach affecting 39 major companies worldwide, exploiting a Salesforce vulnerability to steal 989 million records. They demanded negotiations with Salesforce and the affected firms, threatening to release the data if ignored. When their demands were unmet, SLSH published data allegedly belonging to six companies, including Qantas Airways, Vietnam Airlines, Fujifilm, GAP Inc., Engie Resources, and Albertsons Companies. The leaked datasets reportedly contain extensive personally identifiable information (PII), such as full names, addresses, passport numbers, phone numbers, email addresses, and, in the case of Qantas, detailed frequent flyer information and internal business data. The Qantas dataset alone is said to be 153 GB and includes over 5 million records. The authenticity of the data has been partially verified by independent analysis, though only the affected companies can fully confirm the breach. The exposure of such sensitive information poses significant risks for identity theft, fraud, and targeted attacks against both individuals and organizations. The SLSH collective's actions have prompted calls for increased vigilance and improved cybersecurity measures among large enterprises, especially those using cloud-based platforms like Salesforce. Law enforcement agencies continue to investigate and pursue members of the group, while the cybersecurity community monitors for further developments and potential retaliatory actions promised by SLSH upon their return.
Jun 29, 2026