Loading story…
U.S. authorities moved against Global Hell, a hacking group tied to intrusions, website defacements, and service disruptions affecting government, academic, telecom, and private-sector systems. Federal prosecutors charged Chad Davis, known as Mindphasr, with breaking into a protected U.S. Army computer at the Pentagon, altering the Army homepage, and modifying files on an unclassified Army network to evade detection. Investigators and court records linked the group to attacks on the White House, FBI, Interior Department, Senate, Virginia state systems, and other sites, while one retaliatory campaign reportedly included a denial-of-service attack that temporarily knocked the FBI website offline.
The crackdown widened as investigators pursued suspects across multiple cities and connected other members to additional crimes. Patrick Gregory, known as MostHateD, agreed to plead guilty to conspiracy involving telecommunications fraud and computer trespass, with prosecutors alleging Global Hell caused $1.5 million to $2.5 million in losses across roughly 115 websites and used stolen conference-calling codes to support its operations. Separately, authorities linked a 16-year-old associate of the group to the theft of thousands of Pacific Bell Internet account passwords, forcing resets for 63,000 subscribers and exposing how the crew’s activity extended beyond headline-grabbing defacements into credential theft and broader network compromise.
See the reporting duties and controls this puts on the clock.
8 events from the most recent confirmed update back to the earliest known activity.
Patrick Gregory, the 19-year-old Houston resident known as "MostHateD," agreed to plead guilty to conspiracy involving telecommunications fraud and computer hacking tied to Global Hell. Prosecutors said the group was responsible for intrusions and damage affecting roughly 115 websites, with losses estimated between $1.5 million and $2.5 million, and Gregory agreed to cooperate with investigators.
By late March 2000, reports stated that Global Hell co-founder Chad Davis had already been sentenced to six months in prison for the Army website attack. The sentence followed the earlier federal case over the Pentagon intrusion.
Authorities said a 16-year-old linked to Global Hell hacked Pacific Bell's Internet server and stole thousands of subscriber passwords, prompting a forced reset for 63,000 accounts. Investigators also tied the teen to intrusions at 26 other sites, including a Harvard University master computer system, and said charges were expected.
A Washington Post report said investigators were pursuing suspects in at least 11 cities and linked Global Hell to attacks on U.S. government, state, corporate, and private websites, including the White House, FBI, Interior Department, Senate, and Virginia state sites. The article framed the group as attention-seeking vandals but highlighted official concern about risks to critical information infrastructure.
The U.S. Department of Justice announced charges against 19-year-old Chad Davis of Green Bay, Wisconsin, accusing him of hacking a Pentagon Army computer and disrupting its communications system. Officials identified Davis as a founder of Global Hell and said the case followed an FBI search warrant and a joint FBI-Army investigation.
An attacker allegedly accessed a protected U.S. Army computer at the Pentagon, altered the Army homepage, and modified files on an unclassified network. Authorities later tied the June 28 intrusion to Chad Davis, known as "Mindphasr," after the defacement proclaimed that Global Hell was still active.
Following the Mother's Day raids, attackers launched a denial-of-service attack that temporarily made the FBI website inaccessible. The disruption was reported in late May as part of the fallout from the Global Hell investigation.
Federal authorities conducted coordinated raids against 16 suspected Global Hell members in 12 jurisdictions. The enforcement action became a major trigger for subsequent retaliatory website defacements and disruptions attributed to the group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
8 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcezdnet.com
Open sourcelatimes.com
Open sourceweb.archive.org
Open sourcejustice.gov
Open sourceweb.archive.org
Open sourcezdnet.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice charged seven international defendants, including five alleged members of **APT41**, over computer intrusion campaigns that hit more than 100 victims worldwide. Prosecutors said the group targeted universities, software developers, telecommunications providers, social media companies, video game firms, nonprofits, and foreign governments, stealing source code, customer account data, and personally identifiable information while pursuing both **espionage** and **financial gain**. The indictments describe activity ranging from supply-chain compromises and credential theft to fraud involving in-game currency and other monetization schemes. Reporting tied the charged activity to broader APT41 operations, including **ColdLock** ransomware attacks against Taiwanese organizations, especially in the energy sector. In those intrusions, attackers were observed using **Active Directory Group Policy**, scheduled tasks, **SMB**, **PowerShell**, customized loaders, and **Cobalt Strike** to move laterally and deploy ransomware. Trend Micro said related activity also affected energy, retail, and telecommunications organizations in Southeast Asia, with infrastructure overlaps and targeting patterns suggesting links between criminal operations and Chinese state-aligned espionage.
Aug 14, 2026
Anonymous-affiliated attackers breached **HBGary Federal** after CEO **Aaron Barr** publicly claimed he had identified key members of the collective and was preparing to share findings with the FBI. The intrusion reportedly combined website exploitation, password reuse, and social engineering, leading to the defacement of HBGary systems, takeover of Barr’s Twitter account, theft of more than **50,000 emails**, and exposure of company financial and internal documents. Reporting on the operation described participants from AnonOps and highlighted disputed claims around a hacker using the alias **"Kayla"**, while leaked IRC logs later portrayed Anonymous as more coordinated than its public image suggested, with figures such as **Sabu** directing activity and discussing the HBGary attack. The leaked HBGary emails triggered wider fallout by exposing proposals tied to campaigns against **WikiLeaks** and critics, including plans reportedly prepared for clients connected to **Bank of America** and a law firm, and renewed scrutiny of the firm’s ties to federal agencies. Subsequent reporting said former Anonymous supporters provided chat logs and alleged identities to investigators, and later arrests brought the hacking saga closer to a conclusion. The episode became a defining early example of hacktivist retaliation escalating into a major corporate breach, reputational crisis, and law-enforcement investigation.
Jun 29, 2026
The FBI escalated its investigation into **LulzSec** and affiliated **Anonymous** hackers by seizing server racks from a Reston, Virginia data center used by Swiss host DigitalOne, knocking multiple unrelated websites and services offline. According to reporting, agents were pursuing one customer but removed three equipment enclosures that may have held systems for many other clients, disrupting sites including **Curbed Network**, **Instapaper**, and **Pinboard** even though they were not identified as targets. U.S. officials said the operation was part of an active, broader inquiry supported by other agencies and international cybercrime partners. The enforcement push widened with arrests and searches tied to suspected members on both sides of the Atlantic. British authorities arrested a teenager on suspicion of hacking, while reports also described the arrest in London of a leading LulzSec figure and FBI raids on homes of suspected Anonymous participants in the United States, including a search in Hamilton, Ohio linked to the online alias `m_nerva`. Reporting said investigators drew on evidence connected to Ryan Cleary, who was charged under the UK Computer Misuse Act, as authorities worked to identify participants in the group after a string of high-profile intrusions and internal leaks exposed tensions inside LulzSec.
Jun 29, 2026