apt

SiegedSec

defunctAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Gay Furry HackersSiegedSec CollectiveSieged Security

Attribution

Loosely-organized ideologically-motivated hacktivist collective, not a state-nexus actor. Fronted publicly by an individual using the alias "vio." No credible technical or law-enforcement attribution to a nation-state; membership and geography never authoritatively established.

First seen

2022-04

Last active

2024-07

Motivation

Politically- and socially-motivated hacktivism (leak-and-shame). Campaigns framed around US culture-war and civil-rights issues (pro-choice/anti-abortion-law, pro-trans/anti-anti-trans policy, opposition to Project 2025), anti-NATO/anti-establishment provocation, pro-Palestinian/anti-Israel activism during the 2023-2024 Gaza conflict, and notoriety/lulz. Self-described "gay furry hackers."

Attribution confidence

medium

MENA targeting

Israel

Sectors

Retail/grocery, aviation, government

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel (Retail/grocery, aviation, government sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

CyberAv3ngersactorTechnique overlap
KillSecactorTechnique overlap
Void Manticore (Storm-0842)actorTechnique overlap

Uses

Data from Information RepositoriestechniqueATT&CK mapping
Cloud AccountstechniqueATT&CK mapping
Network Denial of ServicetechniqueATT&CK mapping
Vulnerability ScanningtechniqueATT&CK mapping
Exploit Public-Facing ApplicationtechniqueATT&CK mapping

Observed techniques

7 distinct

Rows marked inferred are OSINT-extracted enrichment for actors without a MITRE Group ID — treat as analyst assessment, not authoritative ATT&CK attribution.

Technique	Name	Tactic	Observed use
T1213 ↗inferred	Data from Information Repositories	Collection	Bulk collection of documents and user records from collaboration/HR platforms: ~710 files and ~8,000 user records from NATO's COI Cooperation Portal (Jul 2023), Oracle HCM at INL (Nov 2023), Heritage Foundation data (Jul 2024).
T1491.002 ↗inferred	External Defacement	Impact	SiegedSec defaced 100+ domains, including five US state-government websites (Nebraska Supreme Court, South Dakota, Texas BHEC, Pennsylvania, South Carolina CJIS) in June 2023 as anti-abortion-law protest.
T1498 ↗inferred	Network Denial of Service	Impact	Oct 2023: claimed DoS attacks with Anonymous Sudan against Israeli ICS/Modbus, building-automation and GNSS-receiver IPs; SecurityScorecard found no evidence the targets were actually disrupted, so this is a claimed rather than confirmed technique.
T1078 ↗inferred	Valid Accounts	Initial Access	Atlassian/Envoy Feb 2023 breach: the group used an Atlassian employee's credentials to authenticate to the Envoy app and pull employee data; Flare notes reuse of leaked credentials as a standard access method.
T1078.004 ↗inferred

Useful?

Regional co-occurrence · associated techniques

Honesty note

Regional co-occurrence is association, not prediction. These techniques appeared alongside SiegedSec's activity across the tracked MENA roster — a TIE-style association computed on our corpus (not CTID's model), not a prediction of the next move. Ranked by support-adjusted lift (over-representation among actors like this one vs. the roster base rate, damped when few actors back it), so neither a merely-common technique nor a tiny-sample coincidence floats to the top. A hunting lead only; never recorded as observed. ICS techniques are excluded.

T1133assoc T1110assoc T1021.001assoc T1560.001assoc T1657assoc T1199assoc T1566assoc T1567.002assoc

Defensive coverage · Microsoft 365

Which Microsoft 365 controls protect, detect, or respond to this actor's techniques — from the CTID Mappings Explorer (technique-level). Strength: significant / partial / minimal.

protect · 3 techniques

Defender for Cloud AppsT1213minimalConditional AccessT1078minimalConditional AccessT1078.004significantConditional AccessT1213minimalIdentity Secure ScoreT1078minimalIdentity Secure ScoreT1078.004partialMultifactor AuthenticationT1078minimalMultifactor AuthenticationT1078.004significantPrivileged Identity ManagementT1078minimalPrivileged Identity ManagementT1078.004partialPasswordless AuthenticationT1078.004significantPassword PolicyT1078significantPassword ProtectionT1078partialRole Based Access ControlT1078minimalRole Based Access ControlT1078.004partialRole Based Access ControlT1213partialAudit SolutionsT1078partialAudit SolutionsT1078.004partialAudit SolutionsT1213partial

detect · 3 techniques

App GovernanceT1078significantApp GovernanceT1078.004significantAdvanced Threat HuntingT1078significantAdvanced Threat HuntingT1078.004significantDefender for Cloud AppsT1078partialDefender for Cloud AppsT1078.004partialDefender for Cloud AppsT1213minimalLateral MovementsT1078partialLateral MovementsT1078.004partialSecurity AlertsT1078significantSecure ScoreT1078minimalSecure ScoreT1078.004minimalSecure ScoreT1213minimalContinuous Access Evaluation

respond · 3 techniques

Automated Investigation and ResponseT1078significantAutomated Investigation and ResponseT1078.004significantIncident ResponseT1078minimalIncident ResponseT1213minimalQuarantine PoliciesT1213significantConditional AccessT1078minimalConditional AccessT1078.004partialID ProtectionT1078.004significant

SiegedSec

Observed techniques

Regional co-occurrence · associated techniques

Defensive coverage · Microsoft 365

Countermeasures · D3FEND