Threat Actor Characterization
We Put Everything First
ID: d3832ef753a7369cd598e0b6fd3d80fd52930| W.P.E.F | WPEF | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
W.P.E.F (We Put Everything First) is an emerging defacement-oriented hacktivist cluster whose current public footprint centers on opportunistic compromise of public-facing websites, visible content tampering, and archive-based amplification of claims.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1491.001 | Internal Defacement | TA0040 |
|
| T1595 | Active Scanning | TA0043 |
|
Preliminary Intelligence — W.P.E.F (We Put Everything First)
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Hacktivism / Defacement Cluster
Origin: Unknown
Executive Summary
W.P.E.F (“We Put Everything First”) is best assessed as an emerging defacement-oriented hacktivist cluster with a visible public footprint in defacement archives and limited but real alliance signaling. The strongest open-source anchors currently available are public team listings in defacement archives, repeated incident records tied to the team name, and a recent alliance announcement involving RAKYAT DIGITAL CREW. Available evidence supports treating W.P.E.F as a real operational label rather than a purely speculative alias, but the current public record does not support high-confidence claims about operator nationality, command structure, or a broader intrusion capability beyond web compromise and public-facing disruption.
At the time of writing, the most visible activity linked to W.P.E.F is mass defacement or mirror-style publication against exposed web properties, often recorded through public cyber-attack archive services. Public records indicate that the alias Poloss is repeatedly associated with W.P.E.F incidents, suggesting either a core operator or at minimum a recurrent public notifier. The observable operating model appears to prioritize public visibility, symbolic impact, and volume over stealth, persistence, or technically complex post-compromise operations.
