Anonymous Sub-Group

A small sub-group of the Anonymous collective has recently initiated underground offerings of hackers-for-hire. The group is known for their past experiences in website defacement and for their participation in #opISIS, #OpIceISIS, #OpKillingBay, and #OpFunKill, which are all official Anonymous operations. The group has a forum based on Tor, which is believed to be for clients to interact with the team, however, no clients have yet posted. Wapack Labs believes the leader and founder of the group has advanced hacking skills. His Instagram and Twitter accounts provide several videos exposing DDoS attacks against websites. The group's leader also has used numerous aliases, which are provided in the report. He was once a member of several other groups, including, Powerful Greek Army (P.G.A), Phantom Squad, and Zero0d3. Wapack Labs will continue to monitor the group, their leader, and their hacker- for-hire Tor based service...READ MORE

Wapack Labs has cataloged and reported on Tor based groups and threat actors in the past. An archive of related reporting can be found in the Red Sky Alliance portal. 

WWW.WAPACKLABS.COM

8chan Vs. Anonymous

On 4 October 2017, Wapack Analysts observed a post made to 8chan’s image board with a link to a raid against Anonymous on the "insurgency" board. Raids are commonly organized on image boards and are the act of harassing an organization by means of exposing one’s personal information (doxing), SWATing, hacking, spamming, prank phone calling, and other forms of remote harassment. The raid organizers claim that they are sick of the Anonymous movement and that hacktivists are a bunch of annoying Social Justice Warriors (SJW). The term SJW is very common derogatory slang among image board users, directed at individuals who fight strongly for a cause. Several doxes of Anonymous members have been posted, but still need to be verified. Alternative communication sources for the raid, such as IRC and Discord, were once active, but currently are not. The raid started in June and is still active on 8chan’s "insurgency" board, but alternative communication sources are no longer active, suggesting the raid is dying down in popularity and will likely soon end. Wapack Labs Analysts will continue to monitor 8chan’s cyber operations, conducted against Anonymous, for any potential implications to our subscribers...READ MORE

Wapack Labs has cataloged and reported image boards and activity involving Anonymous in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

OpIcarus2017, a Limited Risk

In June 2017, Wapack Labs Analysts observed a faction of the Anonymous collective attempting to launch OpSacred, which is the fifth phase of OpIcarus2017; a multiphase operation aimed to target central banks and other financial institutions (i.e.: International Monetary Fund and the World Bank). The campaign attracted hundreds of participants, yet failed to attract AnonOps support, create a dedicated IRC channel, attract experienced organizers, or followup after their initial start day - producing limited effects. While the operation has been badly organized, it may become a training ground for future hacker collaborations, especially since the Anonymous collective has been observed using GitHub to collect and share tools...READ MORE

Wapack Labs has cataloged and reported extensively on Anonymous' operations in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

#OpNoDAPL – Standing Rock “Officials” Doxed

On 12 November 2016, a member of the Anonymous collective posted a Pastebin link containing the names, addresses, phone numbers and emails of various people and agencies involved with the Dakota Access Pipeline (DAPL) Project.  This protest has been on-going since October 2016, but has recently escalated in surface and underground web networks.  This information is being supplied for your situational awareness.

• DAPL protests began in October 2016.

• The Anonymous movement has joined protests against DAPL, and on 12 November 2016 posted to Twitter Personally Identifiable Information (PII) on local Dakota Access Pipeline officials.

• #OpNoDAPL and other associated pipeline protest sites have sparked protests in San Francisco and Washington DC.

@AnPoland and the Bradley Foundation

On 29 October 2016, Anonymous Poland (@AnPoland) claimed to have hacked and downloaded e-files from the Bradley Foundation (BF).  A letter was posted by numerous Anonymous groups which presented a letter explaining a donation of $150 million USD made by the Rothschild Assets Management Company, through the BF, to the Hillary Clinton Campaign.  BF, a traditional conservative foundation, is currently claiming that the posted letter is a fake.  This information is being provided for your situational awareness.

• Anonymous Poland (@AnPoland) was created during 2016 Summer Olympics to hack the World Anti-doping Administration.
• Wapack Labs assesses with moderate confidence that AnPoland is Russian APT.
• Anonymous Poland was the first to report the hack of the Bradley Foundation, placing moderate confidence they are responsible.

Publication date:                           4 November 2016

Handling requirements:               Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:          Anonymous Poland [suspected Russian APT]

Actor Type:                                    Adversary capabilities have been assessed as Tier IV*

Potential Targets:                          Bradley Foundation (other U.S. politically tied foundations)

Past Reporting:                             DOC-4287, DOC-4211

*States with the ability to successfully execute full spectrum (cyber capabilities in combination with all of their military and intelligence capabilities) operations to achieve a specific outcome in political, military, economic, etc. domains and apply at scale.

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.