Loading story…
Hacktivist persona Phineas Fisher remains unidentified despite a string of high-profile intrusions that embarrassed commercial spyware vendors and other political targets. The most consequential attacks attributed to Fisher include the 2014 breach of Gamma Group/FinFisher and the 2015 compromise of Hacking Team, where more than 400 GB of internal data was exposed. The Hacking Team leak fueled reporting on spyware abuses in Ecuador, Mexico, and Panama and is widely seen as a major factor in the company’s eventual collapse.
Authorities have not publicly identified or arrested the person or group behind the alias, and reporting says Italian investigators found no evidence in the Hacking Team case that revealed Fisher’s identity. Additional operations attributed to Fisher include attacks on the Mossos d'Esquadra police union, Turkey’s ruling party, and Cayman National Bank’s Isle of Man branch. Those later actions reinforced Fisher’s reputation as an elusive hacktivist, with the bank intrusion reportedly used in part to fund political causes, including Bitcoin donations linked to Rojava.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Following the Hacking Team breach investigation, Italian authorities were unable to find evidence revealing Phineas Fisher's identity. The failure left the hacker's real identity unresolved.
In 2015, Phineas Fisher breached Italian spyware vendor Hacking Team and exposed more than 400 GB of internal data. The leak enabled reporting on spyware-related scandals in Ecuador, Mexico, and Panama and reportedly contributed to the company's eventual collapse.
In 2014, Phineas Fisher carried out a high-profile intrusion against Gamma Group, the maker of FinFisher spyware. The breach became one of the earliest major operations attributed to the hacktivist persona.
Phineas Fisher later claimed an attack on Cayman National Bank's Isle of Man branch. The operation was described as an effort to obtain funds, with reporting saying some proceeds were used for Bitcoin donations to Rojava and other hacktivist causes.
The references also attribute an intrusion against Turkey's ruling party to Phineas Fisher. It is presented as another politically motivated operation in the hacker's campaign history.
At a later point described in the references, Phineas Fisher was also attributed with an attack against the union of the Mossos d'Esquadra police force. The operation was cited as part of a broader pattern of hacktivist intrusions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anonymous-affiliated attackers breached **HBGary Federal** after CEO **Aaron Barr** publicly claimed he had identified key members of the collective and was preparing to share findings with the FBI. The intrusion reportedly combined website exploitation, password reuse, and social engineering, leading to the defacement of HBGary systems, takeover of Barr’s Twitter account, theft of more than **50,000 emails**, and exposure of company financial and internal documents. Reporting on the operation described participants from AnonOps and highlighted disputed claims around a hacker using the alias **"Kayla"**, while leaked IRC logs later portrayed Anonymous as more coordinated than its public image suggested, with figures such as **Sabu** directing activity and discussing the HBGary attack. The leaked HBGary emails triggered wider fallout by exposing proposals tied to campaigns against **WikiLeaks** and critics, including plans reportedly prepared for clients connected to **Bank of America** and a law firm, and renewed scrutiny of the firm’s ties to federal agencies. Subsequent reporting said former Anonymous supporters provided chat logs and alleged identities to investigators, and later arrests brought the hacking saga closer to a conclusion. The episode became a defining early example of hacktivist retaliation escalating into a major corporate breach, reputational crisis, and law-enforcement investigation.
Jun 29, 2026
U.S. prosecutors indicted Swiss national Till Kottmann, also known as **"deletescape"** and **"tillie crimew,"** on charges including conspiracy, wire fraud, and aggravated identity theft for allegedly hacking dozens of companies and government entities, stealing confidential data and credentials, and publishing material from more than 100 victims online. The indictment says the activity began in 2019 and included intrusions into source code repositories and other systems at major organizations including **Microsoft, Intel, Nintendo, Nissan, Daimler, Disney**, a Washington state agency, and a U.S. government contractor; the FBI also seized the **`git.rip`** domain that investigators said was used to leak stolen data. The case also linked Kottmann to the high-profile **Verkada** intrusion, in which exposed super-admin credentials were allegedly used to access more than **150,000 surveillance cameras** at prisons, hospitals, warehouses, schools, and Tesla facilities. U.S. authorities, working with Swiss counterparts, said search warrants were executed in Lucerne and devices were seized, while media reports noted Kottmann had described the attacks as anti-capitalist hacktivism and "easy" acts of anarchism; prosecutors instead characterized the campaign as criminal theft, fraud, and identity abuse affecting both private companies and public-sector targets.
Jun 29, 2026
Iran-linked hackers operating as the **Handala Hack Team** claimed they breached FBI Director Kash Patel’s personal Gmail account and published excerpts from the stolen material online. Reporting says the leak totaled about **800 MB** and included personal photographs, a purported resume, and hundreds of emails, with exposed correspondence spanning roughly **2010 to 2019** and appearing to contain both personal and work-related messages. A Justice Department official confirmed Patel’s email account had been compromised and said the leaked material appeared authentic, though the emails themselves were not independently verified. Handala framed the intrusion as an embarrassment for U.S. security leadership and warned that if the FBI director could be compromised, other personnel could be targeted as well. Western cybersecurity researchers have assessed Handala as a pro-Palestinian hacktivist persona linked to **Iranian government cyberintelligence units**, and the breach follows other activity attributed to the group, including a claimed attack on medical technology company **Stryker**. The incident also comes after U.S. actions against Handala, including domain seizures and a **$10 million** reward offer tied to identifying members of the group.
Jun 29, 2026