By Daniella J. Ferrante&Thomas J. Holt

There is little research considering the ways that local events in physical space trigger responses from ideological groups in online spaces. This study attempted to address this gap in the literature through the analysis of information from the Extremist Cybercrime Database (ECCD), a unique open-source repository of cyberattacks performed against U.S. targets from 1998to 2020. This qualitative study focused on the language used during cyber-attacks against police agencies by the hacker collective Anonymous.Evidence suggested that the attackers’ language reflected values observed in the hacker subculture to justify their attacks and incorporated negative language regarding law enforcement. This was particularly evident in cases of police excessive use of force against minority groups and emphasized theneed for public protest and social change.
DEVIANT BEHAVIOR 2025, VOL. 46, NO. 9, 1125–1

 By Marco Romagna & Rutger Erik Leukfeldt  

  Hacktivism represents the promotion in the cyber landscape of ideologically motivated agendas using hacking techniques. Despite research on the topic has provided some clues on how hacktivist networks develop, the processes behind their evolution remain mostly unknown. This gap in the literature prompted us to research the role of online/offline social relationships and of the offender convergence settings in the creation, recruitment process and development of hacktivist networks. This study is based on 30 interviews with hacktivists, and it uses the social opportunity structures framework to analyze the development of 21 hacktivist networks. The results show that said networks can be divided in sub-categories based on the type of connections used to create them. Online social relationships and online convergence settings (particularly social media platforms and IRC channels) seem to play a key role in the development of hacktivist networks, while offline contacts are limited. For the recruitment process, hacktivists use comparable strategies to any organization, but three different categories were identified when discussing

VICTIMS & OFFENDERS Published online: 01 Jul 2024

By Marco Romagna&Eric Rutger Leukfeldt

The organizational aspects of hacktivist networks are seldom studied, with research mainly focused on exploratory and descriptive case studies. To narrow the gap, we have used the sociological model for the social organization of deviants developed by Best and Luckenbill (1994). Said model illustrates how hacktivist networks are organized and contributes to a clear-cut categorization useful when dealing with hacktivism. Our study uses a rich dataset obtained from 32 semi-structured qualitative interviews conducted within 23 different networks. By expanding on past research on cybercriminal and hacktivist networks, the results show that hacktivists operate at varying levels of sophistication, favoring small, well-organized teams where roles and tasks are clearly divided. While there are differences among networks, our analysis reveals the importance of individual actions within larger operations: being affiliated with like-minded people, the existence of internal rules, and the importance of hacking skills to determine, if not hierarchies, then who is the most influential. Most of the networks analyzed were classified as “peers” or “teams,” although the landscape shows considerable heterogeneity. Compared to other cybercriminal networks, hacktivists seem to have lower level of sophistication, while embracing the hacking subculture that places importance on the role of the individual within the network.
DEVIANT BEHAVIOR 2025, VOL. 46, NO. 9, 1104–1124

By   Eugenio Benincasa

Recent revelations of Chinese government-backed hacking show a recurring pattern: prominent hackers behind groups such as APT17, APT27, APT41, Flax Typhoon, and Red Hotel—monikers given by cybersecurity researchers for groups with similar tactics—trace their roots to a broader community of early elite hackers, known as “red hackers” or “Honkers” (红客, Hong Ke). Active in online forums during the mid-1990s and 2000s, these hackers operated independently but often aligned with state interests, targeting foreign entities perceived as hostile to China, including the US, Taiwan, and Japan. The author’s analysis builds upon prior research into China’s red hacker groups.

Center for Security Studies (CSS), ETH Zürich . 2025. 74p.

SHAH, MARIAM

The following excerpt from the document contains multiple links embedded in the original text: "Islamic State (IS) recently released a powerful recruitment message for 'distracted Muslim youth' to travel and join IS territories across the world. It highlights a disturbing trend in how terrorist organisations are using technology to recruit and mobilise members through a single message. It also shows that contemporary terror groups and extremist organisations are adapting fast to emerging technologies. This Insight aims to highlight an alarming reality: the exploitation of Artificial Intelligence (AI) technology by terrorist and violent extremist groups to strengthen recruitment efforts. These groups proficiently manipulate online platforms, leveraging sophisticated AI tools to disseminate tailored propaganda content to exploit psychological vulnerabilities and amplify divisive narratives, thereby fostering radicalisation and recruitment. From using encrypted messaging apps like Telegram and WhatsApp to seeking refuge in the anonymity of the Dark Web, these groups employ various tactics to evade AI detection and exploit vulnerabilities. By leveraging AI tools, these groups engage in personalised messaging, rapid distribution, and exploitation of social media algorithms to amplify their reach and influence susceptible individuals."

GLOBAL NETWORK ON EXTREMISM AND TECHNOLOGY (GNET). 4 JUL, 2024. 8p.