Hacktivism, commonly known as actions by individuals or groups that using hacking skills to spread a specific message and bring attention to a political or social cause, has risen and then fallen globally in the past five years. In the meantime, hacktivist activities have evolved, with an increase in state-sponsored hacktivism using false hacktivist personas, and the appearance of hacktivists who could also be described as "entrepreneurial geeks." Not all hacktivists break into network systems; some perform troll activities to create online disruptions on social media to accomplish their goals. The recent phenomenon of fandom nationalists turned trolls adds another layer to the many roles of hacktivism. This talk will discuss the role of hacktivism in information operations through case studies of hacktivist activities from various regions and countries, and provide insight into the structure, organization, motivations, goals, tactics, techniques, and procedures (TTPs) of these hacktivist groups. The talk will also analyze how other threat actors utilize hacktivists to conduct information operations. Lastly, the talk will reflect on the future direction of global hacktivism in information operations as geopolitical tensions among major powers increase and nation-states reposition their cyber defense posture. Hacktivism is evolving in the disinformation age with traditional hacktivist activities of breaking into systems and emerging hacktivist activities of creating online disruptions without breaking into systems. Hacktivist actors are not only non-state actors, but also nation state actors who use false hacktivist personas conducting information operations.

1. HACKING&TROLLING
THECHANGINGFACE
OFHACKTIVISMIN
THEDISINFORMATION
AGE
iDefense Threat Intelligence
Mei Nelson
December 11, 2019

2. © 2019 Accenture.
ACCENTURE SECURITY
Accenture Security helps organizations build resilience from the inside out, so they can confidently focus on
innovation and growth. Leveraging its global network of cybersecurity labs, deep industry understanding
across client value chains and services that span the security lifecycle, Accenture protects organizations’
valuable assets, end-to-end. With services that include strategy and risk management, cyber defense, digital
identity, application security and managed security, Accenture enables businesses around the world to defend
against known sophisticated threats, and the unknown. Follow us @AccentureSecure on Twitter or visit us at
www.accenture.com/security.
This document is produced by consultants at Accenture as general guidance. It is not intended to provide
specific advice on your circumstances. If you require advice or further details on any matters referred to,
please contact your Accenture representative.
The opinions, statements, and assessments in this report are solely those of the individual author(s) and do not
constitute legal advice, nor do they necessarily reflect the views of Accenture, its subsidiaries, or affiliates.
LEGAL NOTICE & DISCLAIMER
Copyright © 2019 Accenture. All rights reserved.

3. WHO AM I
3
Copyright © 2019 Accenture Security. All rights reserved.
Mei Nelson
Security Principal
Geopolitical and Strategic
Intelligence Team
iDefense Threat Intelligence
Accenture Security
Accenture

4. HACKER – HACKTIVIST – HACKTIVISM
Copyright © 2019 Accenture Security. All rights reserved.
Using hacking skills to spread a specific message and bring attention to a political
or social cause
or
The use of malicious cyber activities by non-state actors for ideological purposes
(iDefense)
Hacktivist
Hacker + Activist
Combines traditional activist tactics with hacking techniques
Hacktivism
Hacker

5. 5
HACKTIVISM
Decline?
Copyright © 2019 Accenture. All rights reserved.
The Cult of the Dead
Cow - the Dead Cow
Died?
Source: cDC
Source: Google

6. 6
HACKTIVISM
Changing Face?
Copyright © 2019 Accenture. All rights reserved.
Source: Wikimedia

7. 7
THE CHANGING FACE OF
Hacktivism
Copyright © 2019 Accenture. All rights reserved.
Non-state Actors
State Actors

8. 8
THE CHANGING FACE OF
Malicious Cyber Activities
Breaking into No Breaking into
Systems Systems
Hacktivism
Copyright © 2019 Accenture. All rights reserved.

9. HACKTIVISM
&
THEDISINFORMATION AGE
Copyright © 2019 Accenture. All rights reserved.

10. Disinformation
Propaganda
Misinformation
10Copyright © 2019 Accenture. All rights reserved.
INFORMATION OPERATIONS
THREE TYPES & THREE DIMENSIONS

11. DISINFORMATION OPERATIONS
GOALS: THE “D” WORDS
11
DIVIDE DISCREDIT DISTRACT DENY
Copyright © 2019 Accenture. All rights reserved.

12. DISINFORMATION OPERATIONS
METHODS
12
“WHITE” METHOD
Broadcasting one’s
message openly
through state
media
“GRAY” METHOD
Placing information in
other sympathetic
media
“BLACK” METHOD
Using hackers,
trolls, and
honeypots
Copyright © 2019 Accenture. All rights reserved.

13. 13
• Flooding the media with multiple versions of a story to
confuse the audience
• Publicizing scandalous information to discredit a critic
or adversary
• Distracting world opinion from negative information,
by highlighting or even creating some other crisis or
scandal
• Using inauthentic social media profiles to inflame real-
world violence by publicizing rallies of rival groups
Copyright © 2019 Accenture. All rights reserved.
DISINFORMATION OPERATIONS
TACTICS

14. 14
CYBER-ENABLED INFORMATION OPERATIONS
Broadly
Any information operations taking place in
cyberspace, including in online media and social
media
Narrowly
Information operations leveraging offensive
cyber threat activity such as subverting secure
system
Copyright © 2019 Accenture. All rights reserved.

15. 15
CYBER-ENABLED INFORMATION OPERATIONS
Hacktivism
Non-state actors for
ideological purposes
State-controlled
hacktivism using false
personas
Copyright © 2019 Accenture. All rights reserved.
State-encouraged
hacktivism trolling

16. 16
CASE STUDY: #MACRONLEAKS (PART I)
• Disinformation campaign: rumors,
fake news, forged documents
• Offensive network intrusion:
computers of Macron’s campaign
staff
• Spreading stolen data using trolls
and bots
Source: Reuters
Copyright © 2019 Accenture. All rights reserved.

17. CASE STUDY: #MACRONLEAKS (PART II)
17
• Spear phishing campaign
• Hacktivist personas
• Social media bots
• Imagery board: 4chan
SNAKEMACKEREL (APT 28)
Copyright © 2019 Accenture. All rights reserved. Source: Fancy Bears’ Hack Team website

18. 18
SKATE
Copyright © 2019 Accenture. All rights reserved.
CASE STUDY: ENDLESS MAYFLY & OPERATION
NEWSCASTER
1. Used typo-squatted domains to create
inauthentic websites
2. Promoted these domains on social
media platforms using inauthentic
personas
3. Hosted malicious mobile applications
4. Leveraged “ephemeral disinformation”
– Burn After Reading
18

19. CASE STUDY: CYBER-NATIONALISM TO FANDOM
NATIONALISM
19
Cyber-nationalism
Copyright © 2019 Accenture. All rights reserved.
Born with
nationalistic and
patriotic
sentiment
State-influenced
“Striking-back”
principle: “we will
not attack unless
we are attacked”
Following key
historical dates
and international
events involving
in state’s
interests

20. CASE STUDY: CYBER-NATIONALISM TO FANDOM
NATIONALISM
20
Fandom Nationalism
Copyright © 2019 Accenture. All rights reserved.
Born with
nationalistic and
patriotic
sentiment
State-influenced
“Striking-back”
through social
media
Following
international events
involving in state’s
interests

21. CASE STUDY: CYBER-NATIONALISM TO FANDOM
NATIONALISM
21
Diba Expedition
Copyright © 2019 Accenture. All rights reserved.
Actor:
Warriors/Crusaders
Weapon:
Emoji packs
Battlefield:
Social media
platforms
Goal:
National unity?

22. WHEREISTHIS
HEADING?
22Copyright © 2019 Accenture. All rights reserved.

23. 23
This Photo by Unknown Author is licensed under CC BY
This Photo by Unknown Author is licensed under CC BY
HACKING

24. A FOREVER WAR OF DECEPTION:
DEEPFAKES EMERGE
24

25. 25
SUGGESTIONS
• Follow geopolitical events
• Set social media policies
• Filter inauthentic accounts
• Verify claims
• Investigate information sources
Copyright © 2019 Accenture. All rights reserved.