DarkOwl Profiles SiegedSec, Linking Group to Defacements and Data Leaks
Summary
DarkOwl says SiegedSec defaced websites and leaked data linked to at least 30 companies. The analysts describe the group’s activity, possible members and affiliations, while noting the full impact of its attacks is unknown.
Key points
- DarkOwl analysts observed evidence of SiegedSec defacing or compromising at least 11 websites and claiming to have defaced more than 100 domains.
- The group has reportedly leaked emails or databases associated with at least 30 companies across multiple industries and countries; the overall damage is unknown.
- In April, spokesperson YourAnonWolf reportedly posted data from 17 organizations, including usernames, email addresses and hashed passwords.
- SiegedSec claimed to have targeted India-based NewsVoir and leaked an archive of 27GB of documents, plus a separate archive said to contain source code and API data.
- DarkOwl found possible links between SiegedSec and GhostSec, while noting uncertainty about some members’ identities and aliases.
- The article says there is no indication SiegedSec uses ransomware or has attempted to sell stolen data; DarkOwl warns leaked information could be used by other threat actors.
Article Details
- Event Type
- DarkOwl analysis of SiegedSec, a newly identified cyber threat group, documenting its defacements, compromises, and data leaks.
- Impact
- DarkOwl observed evidence of at least 11 website defacements or compromises and leaks involving data from at least 30 companies. In one reported case, SiegedSec claimed to have exfiltrated 27GB of documents and a separate archive of source code and API data from NewsVoir. The extent of damage is unknown; the article reports no indication of ransomware use or attempted sale of stolen data.
People
cialulzDescribed as a possible SiegedSec member who uses the group's hashtag; the article notes some aliases may be alternate accounts.SryakaradIdentified as a contributor to SiegedSec in connection with a data leak from e-paper.pakistan; often shortened to Sry.YourAnonWolfSiegedSec's prominent spokesperson and leader, according to the article; publicly claimed membership in both SiegedSec and GhostSec.
Threat Actors
AnonymousNamed as a group with which YourAnonWolf was historically active in campaigns.AxoSecGroup YourAnonWolf claimed prior affiliation with; the article says the status of this cyber cell is unclear.BreachSecGroup YourAnonWolf claimed prior affiliation with; the article says the status of this cyber cell is unclear.GhostSecHacking group associated with SiegedSec; the article reports membership overlap and that YourAnonWolf declared membership in both groups.HackersGhost25Group YourAnonWolf claimed prior affiliation with; the article says the status of this cyber cell is unclear.LAPSUS$Cyber threat group cited as a comparison to SiegedSec.LulzSecCyber threat group compared with SiegedSec in the article; described as having conducted attacks for the 'lulz'.SiegedSecCyber threat group that the article reports defaced and compromised websites and leaked stolen data.
Products
Countries
Costa RicaWe’ve witnessed victims announced from India, Pakistan, Indonesia, South Africa, USA, Philippines, Costa Rica, Mexico, and others.IndiaWe’ve witnessed victims announced from India, Pakistan, Indonesia, South Africa, USA, Philippines, Costa Rica, Mexico, and others.IndonesiaWe’ve witnessed victims announced from India, Pakistan, Indonesia, South Africa, USA, Philippines, Costa Rica, Mexico, and others.MexicoWe’ve witnessed victims announced from India, Pakistan, Indonesia, South Africa, USA, Philippines, Costa Rica, Mexico, and others.PakistanWe’ve witnessed victims announced from India, Pakistan, Indonesia, South Africa, USA, Philippines, Costa Rica, Mexico, and others.PhilippinesWe’ve witnessed victims announced from India, Pakistan, Indonesia, South Africa, USA, Philippines, Costa Rica, Mexico, and others.South AfricaWe’ve witnessed victims announced from India, Pakistan, Indonesia, South Africa, USA, Philippines, Costa Rica, Mexico, and others.United StatesWe’ve witnessed victims announced from India, Pakistan, Indonesia, South Africa, USA, Philippines, Costa Rica, Mexico, and others.
Industries
financeThey have successfully targeted companies across numerous diverse industry sectors around the globe including healthcare, information technology, insurance, legal, and finance.HealthcareThey have successfully targeted companies across numerous diverse industry sectors around the globe including healthcare, information technology, insurance, legal, and finance.Information TechnologyThey have successfully targeted companies across numerous diverse industry sectors around the globe including healthcare, information technology, insurance, legal, and finance.InsuranceThey have successfully targeted companies across numerous diverse industry sectors around the globe including healthcare, information technology, insurance, legal, and finance.LegalThey have successfully targeted companies across numerous diverse industry sectors around the globe including healthcare, information technology, insurance, legal, and finance.MediaThe extent of damage caused by cyberattacks conducted by SiegedSec is unknown and many of them have not been mentioned by public news media sources.