StealthMole Traces Night Hunters’ Network and Retaliatory Operations
Summary
StealthMole traces The Night Hunters’ fragmented Telegram and social-media network, linking it to seven defacement alerts and actor-published claims of database, government and industrial-control access. The claims are not independently verified.
Key points
- StealthMole’s Defacement Alert returned seven victims associated with activity from May 2024 to January 2025, with targets in Pakistan, Bangladesh, Colombia and the United States.
- The Telegram investigation found active and inaccessible channels, redirects and historical references, alongside linked Instagram and X profiles using shared branding and links.
- Posts from August 4–15 framed planned or claimed activity as retaliation and included messages such as “OP_PRALAY COMING.”
- The group published files and posts claiming access to Pakistan Railways databases and other government data; the article does not independently verify these intrusions.
- Other actor-published claims involved PLC systems at Dhaka Water Supply and Sewerage Authority and Tenaga Nasional Berhad, plus an Indonesian solar-energy monitoring system.
- The investigation connects the group’s public identity, communications and claims, while cautioning that claimed alliances and operations are not independently confirmed.
- Background intelligence cited in the article associates the group with tools including SQLmap, Nikto, Weevely, GoldenEye, Hulk and Xerxes.
Article Details
- Attack Vectors
- Website defacement, observed in defacement alerts attributed to The Night Hunters.
- SQL database compromise and document or data leaks, claimed by the group in posts showing files or screenshots.
- Access to industrial-control and PLC systems, claimed in posts concerning water, electricity, and solar-energy infrastructure.
- Defensive Notes
- Treat the group's breach and industrial-control access claims as unverified unless independently corroborated; the article says several claims are supported primarily by material published by the group.
MITRE ATT&CK
Threat Actors
Products
InstagramThe Instagram account identified during the investigation was:SQL ServerAnother post claimed a breach of a Pakistan Government SQL Server and described the material as office documents.TelegramBy August 2026, however, the group’s Telegram presence had become fragmented.XX account: https://x.com/Th******H
Tools
GoldenEyeThe background intelligence associated with the group also identifies the use of tools such as SQLmap, Nikto, Wpseku and Sublist3r, alongside Weevely, GoldenEye, Hulk and Xerxes.HulkThe background intelligence associated with the group also identifies the use of tools such as SQLmap, Nikto, Wpseku and Sublist3r, alongside Weevely, GoldenEye, Hulk and Xerxes.NiktoThe background intelligence associated with the group also identifies the use of tools such as SQLmap, Nikto, Wpseku and Sublist3r, alongside Weevely, GoldenEye, Hulk and Xerxes.sqlmapThe background intelligence associated with the group also identifies the use of tools such as SQLmap, Nikto, Wpseku and Sublist3r, alongside Weevely, GoldenEye, Hulk and Xerxes.Sublist3rThe background intelligence associated with the group also identifies the use of tools such as SQLmap, Nikto, Wpseku and Sublist3r, alongside Weevely, GoldenEye, Hulk and Xerxes.WeevelyThe background intelligence associated with the group also identifies the use of tools such as SQLmap, Nikto, Wpseku and Sublist3r, alongside Weevely, GoldenEye, Hulk and Xerxes.WpsekuThe background intelligence associated with the group also identifies the use of tools such as SQLmap, Nikto, Wpseku and Sublist3r, alongside Weevely, GoldenEye, Hulk and Xerxes.XerxesThe background intelligence associated with the group also identifies the use of tools such as SQLmap, Nikto, Wpseku and Sublist3r, alongside Weevely, GoldenEye, Hulk and Xerxes.
Countries
BangladeshThe visible results included targets in Pakistan, Bangladesh, Colombia and the United States.ColombiaThe visible results included targets in Pakistan, Bangladesh, Colombia and the United States.IndiaEmerging around 2022 and identifying strongly with India, the group has built its online identity around a simple idea: retaliation.IndonesiaTheir targeting has not remained limited to one country either, with activity linked to Pakistan as well as infrastructure in countries such as Indonesia and Malaysia.MalaysiaTheir targeting has not remained limited to one country either, with activity linked to Pakistan as well as infrastructure in countries such as Indonesia and Malaysia.PakistanThe group is primarily associated with an anti-Pakistan stance, while its public messaging has also shown support for Israel and hostility toward actors it considers opposed to India.United StatesThe visible results included targets in Pakistan, Bangladesh, Colombia and the United States.