By Stibbe, D., Ruiter, S., Steenbeek, W., & Moneva, A.

This online field experiment tested how risk and reward cues in (fake) account credential ads on a hacker forum influence target selection for account hijacking. High-risk posts, warning of account monitoring, received fewer views, while high-reward posts, promising benefits, attracted more. An unexpected law enforcement operation targeting an illicit marketplace created a natural experiment, triggering increased removals of high-risk posts by forum administrators, which slowed over time. These findings suggest hacker forum users respond rationally to risk and reward cues in target selection, and forum administrators adapt their moderation efforts in response to external threats to reduce perceived risk.

DEVIANT BEHAVIOR 2025, VOL. 46, NO. 9, 1172–1193

By Marco Romagna&Eric Rutger Leukfeldt

The organizational aspects of hacktivist networks are seldom studied, with research mainly focused on exploratory and descriptive case studies. To narrow the gap, we have used the sociological model for the social organization of deviants developed by Best and Luckenbill (1994). Said model illustrates how hacktivist networks are organized and contributes to a clear-cut categorization useful when dealing with hacktivism. Our study uses a rich dataset obtained from 32 semi-structured qualitative interviews conducted within 23 different networks. By expanding on past research on cybercriminal and hacktivist networks, the results show that hacktivists operate at varying levels of sophistication, favoring small, well-organized teams where roles and tasks are clearly divided. While there are differences among networks, our analysis reveals the importance of individual actions within larger operations: being affiliated with like-minded people, the existence of internal rules, and the importance of hacking skills to determine, if not hierarchies, then who is the most influential. Most of the networks analyzed were classified as “peers” or “teams,” although the landscape shows considerable heterogeneity. Compared to other cybercriminal networks, hacktivists seem to have lower level of sophistication, while embracing the hacking subculture that places importance on the role of the individual within the network.
DEVIANT BEHAVIOR 2025, VOL. 46, NO. 9, 1104–1124

By   Eugenio Benincasa

Recent revelations of Chinese government-backed hacking show a recurring pattern: prominent hackers behind groups such as APT17, APT27, APT41, Flax Typhoon, and Red Hotel—monikers given by cybersecurity researchers for groups with similar tactics—trace their roots to a broader community of early elite hackers, known as “red hackers” or “Honkers” (红客, Hong Ke). Active in online forums during the mid-1990s and 2000s, these hackers operated independently but often aligned with state interests, targeting foreign entities perceived as hostile to China, including the US, Taiwan, and Japan. The author’s analysis builds upon prior research into China’s red hacker groups.

Center for Security Studies (CSS), ETH Zürich . 2025. 74p.

Aims

This review seeks to synthesise existing research on transnational mechanisms and processes to provide insights into the factors that shape protest-extremism dynamics to address the following primary research questions::

1. What increases the vulnerability of protest mobilisations to transnational actors (states, violent movements, individuals) promoting violence across borders?

2. What factors constrain the potential for violence, radicalisation, and terrorism in transnational social movements/ mobilisations?

3. Under what conditions do alliances between social movements and international actors lead to an increased potential for violence? What characteristics of both types of actors contribute to this dynamic?

4. What are the mechanisms of influence between transnational and local protest mobilisations?

Methodology 

This research uses a rapid evidence assessment (REA) approach, synthesising knowledge on specific topics in line with the research questions from published journal articles, book chapters, reports, and dissertations, including both academic and “grey” literature (e.g., government and think tank reports).

The REA adopted a streamlined methodology using keyword searches of major social science databases, after which identified documents were screened for inclusion based on pre-determined eligibility criteria.

Key findings 

The literature on both transnational protests and transnational interactions with local movements or protests does not significantly differ from the core findings of the previous two Rapid Evidence Assessments in this series which focused on social movement insights into violent protests (Salman, Marsden, Lewis, 2025) and interdisciplinary research into individual-level processes that shape radicalisation and violence related to protests (Peterscheck, Marsden & Salman, 2025). Earlier findings that remain highly relevant to transnational processes include:

• Movement schism and fragmentation may increase potential for violence.

• Exposure to misinformation influences protest dynamics in ways which can increase the danger of violent escalation.

• The potential for counter-messaging to be counter-productive by producing unintended effects like reinforcing commitment to pre-existing positions, enhancing grievances like perceived discrimination, and reinforcing identities.

• Digital platforms play a role in forging collective identities, including or especially transnational ones.

• Fringe political movements are associated with increased acceptance of political violence.

• Identity fusion, especially in relation to perceived threats against a group, increases the salience of group identity and individual commitment to actions in support or defence of the group, even at cost to the individual.

• Perceptions of existential threats, discrimination, collective angst, and shared grievances can intensify group identity.

The social movement literature has developed a significant body of work on transnational movements. The key insights from the social movement and interdisciplinary literature on violence and protests also help to interpret cross-border influences. Transnational perspectives primarily add another layer of interaction, mutual influence, and opportunities for resource sharing and mobilisation. However, the mediating factors that influence contemporary social movement mobilisations, including new technology and the role of social media and their influence on violence have received less attention. This is particularly the case when violence is informed by local events and dynamics, but is influenced by transnational actors and processes. This suggests a broader gap to be filled by future research on the questions outlined in this report. 

London: CREST, The Centre for Research and Evidence on Security Threats , 2025. 48p.