Threat Actor Characterization
AnonGhost Team
ID: 334b1921135ff440ee5b4fd6e6e2ecbd37228| AG | AGT | An******* | An************* |
| An************ | An*********** | ÁÑ************ | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
93273492f0bab116f76a31e91852d686 | Anonymous Israel | Israel | ally-of | Hacktivist Group |
|
88b6d949d88a6fde51a3fee68408b13736772 | n0name hax0r | Unknown | member-of | Hacktivist Group |
|
78dd1c3c3dfc6fcbbda95d743ab0e2f732121 | NoName057(16) | Russia | ally-of | Hacktivist Group |
|
29a0765877c8ff945846d15b13866e4784732 | Pro‑Palestine Hackers Movement | Palestine | ally-of | Hacktivist Group |
|
37e5d5a62716683494d8b3630bbdf66e75511 | Virusa Worm | Unknown | member-of | Cybercrime |
Related files
| Filename | Size | SHA-1 | OS target | Identified |
|---|---|---|---|---|
| RedAlert.apk | 9.06 MB | d3031888************************9585d6cf | Malware | |
|
AnonGhost2013 by Virusa Worm.php AnonGhost Bypass Shell 2013
|
84.19 KB | 922b91b1************************bffe836d | Malware |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
AnonGhost Team is a pro-Palestinian hacktivist collective that in October 2023 abused a rocket-alert app’s API to push fake nuclear-attack notifications and distributed a malicious Android clone of the RedAlert app from a look-alike site to harvest device data.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1204.002 | Malicious File | TA0002 |
|
| T1491 | Defacement | TA0040 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
AnonGhost Team is a pro-Palestinian hacktivist collective that surged in visibility during 2023-10 amid the Israel–Hamas war. Open reporting attributes to AnonGhost two distinct lines of activity: (1) messaging and nuisance ops (defacements/DDoS claims) amplified via Telegram, and (2) a targeted influence/collection operation abusing Israel’s rocket-alert ecosystem. In 2023-10, researchers reported AnonGhost exploited an API flaw in one Red Alert–branded app to push fake “nuclear strike” alerts to users, and distributed a malicious Android clone of the RedAlert app from a look-alike website that harvested device data and communications. These activities show intent to deceive, alarm, and collect rather than to deploy bespoke destructive malware. Overall confidence in these core facts is high based on primary technical analyses and contemporaneous reporting.
- Industries/Sectors: Public-safety alerting (civil defense apps); Government/public communications; Media & social platforms supporting conflict narratives.
- Geography (Region): Middle East (Israel); global information space via social channels.
- Countries (if available): Israel (users of Red Alert/RedAlert apps).
- Timeframe: 2023–2025 (documented ops from 2023-10-09/14; ongoing hacktivist claims in later reporting).
