Hacktivism.

What is hacktivism?

Hacktivism is the use of hacking to push a political, social or ideological cause. The word joins “hacking” and “activism”. A person who does this is a hacktivist, and a team that works together is a hacktivist group.

The aim is usually to make a point or draw attention, not only to make money. That is a plain description of the idea, and real cases can mix motives.

What do hacktivists do?

ENISA, the European Union Agency for Cybersecurity, describes hacktivist-led DDoS campaigns that target essential entities. ENISA also says public administrations in the EU are increasingly targeted by hacktivists, who primarily resort to DDoS attacks.

A DDoS attack is a distributed denial-of-service attack. CISA, the US Cybersecurity and Infrastructure Security Agency, explains that a denial-of-service attack happens when legitimate users cannot reach information systems, devices or other network resources because of the actions of a malicious cyber threat actor. It becomes a distributed attack when multiple machines work together to attack one target.

How common is it?

ENISA says ideology-driven DDoS attacks accounted for 82% of the recorded events in the threat picture for public administrations. ENISA also says geopolitical developments still influence cyber activity affecting the EU. These statements come from one ENISA page, so they describe what ENISA recorded and not every sector everywhere.

A simple illustration

This is a generic illustration, not a real case. A group posts a message about a cause it supports. It then directs many machines to send traffic at the public website of an organization it opposes. Legitimate visitors can no longer reach the site. The group hopes the outage will bring attention to its message.

How can an organization reduce the risk?

For DDoS attacks, CISA suggests several steps. These include enrolling in a DoS protection service that detects abnormal traffic flows and redirects traffic away from your network, installing and maintaining antivirus software, installing a firewall and configuring it appropriately, and creating a disaster recovery plan.

If you think you are under attack, CISA says to contact your network administrator to confirm whether the outage is due to maintenance or an in-house network issue.

How does it relate to nearby terms?

Hacktivism is a type of motive, not a single technique. One common method named by ENISA is the DDoS attack. A related term is the data breach, which is a different kind of event in which data is exposed. The two can be linked in some cases, but the sources read for this page do not say how often.

Is hacktivism the same as a DDoS attack?

No. Hacktivism describes why someone attacks, which is a cause or belief. A DDoS attack describes how the attack works. Hacktivists often use DDoS attacks, according to ENISA, but other actors can use them too, and hacktivists could use other methods.

Is a hacktivist the same as a criminal or a state actor?

Not by definition. The word points to the ideological aim. ENISA uses the phrase ideology-driven for these attacks. Who is behind an attack, and why, is often hard to confirm, so careful analysts attribute activity only when evidence supports it.

Is hacktivism legal?

This page gives no legal advice. Attacks that make systems unavailable are described by CISA as the actions of a malicious cyber threat actor.