CLASSIFICATION: Unclassified / Open Source

Executive Summary

GhostSec (Ghost Security) began as an Anonymous-adjacent vigilante effort against ISIS propaganda channels (2015), then evolved through 2022–2024 into a brand that mixed hacktivist operations with revenue-seeking offerings (paid “premium” access, services, RaaS “GhostLocker”). In mid-May 2024, GhostSec publicly announced it was exiting the cybercrime/ransomware scene, transferring GhostLocker to the Stormous crew, and “returning to hacktivism.” Multiple independent vendors and media documented the RaaS phase (pricing, features, affiliate/referral model) and the later announcement of the handoff/exit. The group’s narrative remains fluid; capabilities observed range from typical hacktivist defacement/DDoS claims to commodity ransomware and opportunistic ICS/OT “proofs,” with most impactful tradecraft aligning to financially motivated operations in 2023–early 2024. Confidence: high on the chronology (2015–2024); medium on current 2025 posture.

• Origins: Anonymous-adjacent, anti-ISIS vigilante brand; later split/variants (Ghost Security Group vs. GhostSec proper) in 2015.
• Revenue phase (2022–2024): Public “GS Premium” paywall and affiliate program via Telegraph post (09-04-2022), advertising private leaks, consulting, “0-days,” and site/network takedowns.
• RaaS phase (2023–2024): GhostLocker marketed on Telegram with entry fees, referrals, and affiliate perks; multiple vendors produced technical analyses.
• Exit declaration (2024-05-15): GhostSec said it would retire from cybercrime/ransomware, hand GhostLocker v3 to Stormous, and refocus on hacktivism; third-party investigations referenced the statement. INFERENCE: GhostLocker operations likely continued under Stormous management.