FunkSec

FunkSec emerged in late 2024 and quickly drew attention by claiming roughly 85 victims in December 2024, per Check Point Research. It presents as a RaaS using double extortion (data theft plus encryption) and mixes cybercrime with hacktivist messaging. Check Point assessed that some of its tooling — including a custom encryptor (FunkLocker), a DDoS tool, and utilities — was likely produced with AI assistance by a relatively inexperienced author assessed as likely based in Algeria, which may explain the group's rapid iteration.

By early 2025, FunkSec had been linked to 120+ claimed victims across government, defense, technology, financial services and higher education. Researchers have cautioned that the group's claim volume and low apparent sophistication mean many listings may be inflated, recycled, or partly fabricated.

FunkSec has claimed victims in Egypt among its listings. Given the noted reliability concerns, these leak-site claims should be treated as unverified allegations rather than confirmed breaches unless independently corroborated.