Threat Actor Characterization
Libyan Ghosts Hackers
ID: 6494989de35ea7cd846ad9152c24ed5a| LGH | LGH Team | Li*********** | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
63c64603a55314b9fe2197675f77e1c7 | Alansary LY | Libya | member-of | Hacktivist Group |
|
|
0be0d02da1780eddd7c724c1a7379b8c | Ly Forbidden | Libya | member-of | Hacktivist Group |
|
|
4c7c4853e5e69b70e5eacd9bbc0f61ba | Ly_Kermit | Libya | member-of | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Libyan Ghosts Hackers (LGH) — Libya-linked defacement collective with public Facebook/Telegram presence. Activity centers on symbolic web defacements claimed by handles such as Ly_Kermit, Hacking Alansary LY, and Ly Forbidden, with Zone-H mirrors used for proof. In Oct 2023, threat monitoring noted LGH targeting smaller Israeli websites during the Israel–Hamas conflict. Capability assessed as low; impact primarily reputational/propaganda.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1491.002 | External Defacement | TA0040 | |
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1585 | Establish Accounts | TA0042 |
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Libyan Ghosts Hackers (LGH) is a Libya-linked defacement collective active across the 2010s and resurfacing in 2023–2024 with renewed propaganda and small-scale web compromises. The group maintains public Facebook and Telegram presences that attribute defacements to named handles (e.g., Ly_Kermit, Hacking Alansary LY, Ly Forbidden) and showcase Zone-H mirrors and “Hacked by” videos. In October 2023, threat-intel reporting flagged Libyan Ghosts as a “new defacement group” hitting smaller Israeli websites amid the Israel–Hamas war information environment. Overall capability: low (scripted defacements and opportunistic web exploitation), with effects driven by symbolism and local/regional propaganda rather than sustained access. Confidence: medium (actor-run channels + third-party monitoring).
- Brand & footprint. LGH styles itself as a “team” (LGH Team / Libyan Ghosts Hackers Exploits) with public posting on Facebook (page followers ~2k) and a Telegram channel that advertises a Zone-H notifier archive and lists crew handles. Facebook
