The Unusual Suspects: The Activist 2020 The Activist takes their political, religious or social cause outside the rule of law and onto the internet. They actively set out to target individuals or groups they disagree with using the power of the keyboard and the hacker’s toolbox to harm reputations, steal data or target infrastructure. They’re more likely to cause visible damage than to conduct their activities covertly.
The Activist’s tactics can be crude and impulsive - but can also be singularly effective, and bring the age-old question of ‘terrorist, or freedom fighter?’ into the modern age. The Activist may turn out to be a common criminal, hiding their activity behind a popular cause. They can also provide a convenient ‘false flag’ for - or be a puppet of - more sophisticated actors, including nation state espionage groups.


The Activist has a cause, and aims to further it with all kinds of cyber activity. They may not have an ’A’ grade in hacking, or be as organised as other attackers, but they can and will disrupt their targets’ activities, discredit their operations and steal sensitive data to draw attention to or otherwise further their goals.
The Activist knows that the internet allows them to cause trouble at a distance; they can then go public with a claim of responsibility at a time of their choosing to gain maximum media exposure. By operating under the banner of a collective such as Anonymous, and taking further steps to conceal their identity, the Activist protects him or herself from law enforcement. 
The Activist’s work costs money, and the way these threat actors are funded is often opaque and nuanced; very few receive a paycheque and funds for equipment and services direct from their sponsors. Instead, non-hierarchical arrangements with multiple sponsors who provide resources in exchange for expertise, project work and access to services allow the Activist to stay afloat. 


The Activist is often motivated by a strong moral, religious or political belief – or, in some cases, simply the desire to cause havoc. Whatever the Activist’s cause, it is a burning one. From Anonymous (whose many causes include internet freedom, transparency and human rights) through to the pro-Assad Syrian Electronic Army, activists are motivated by a desire to change something and will seek out all available opportunities to promote their cause.
While the tactics employed may be similar, different groups have wildly different aims and may even be diametrically opposed.
Anonymous is perhaps the most infamous Activist group, followed by LulzSec and LizardSquad.
The identity and makeup of these groups is continually evolving as a result of their organisational structure, and they tread a fine line between being seen as ‘white hat’ groups (acting as ‘vigilantes’ for the ‘greater good’) or ‘black hat’ groups (causing disruption and damage to innocent targets). 
Activists may also be sponsored by nation states or political regimes, as is suspected to be the case with the Syrian Electronic Army. Furthermore, other groups may pay lip service to popular causes in pursuit of their own ends. They may claim lofty ethical intentions, while simultaneously extorting money or stealing data for re-sale on the black market.  

Modus Operandi

The Activist pursues a number of different avenues to reach their goals. The most popular tactic is the defacement of web sites, or compromise (and subsequent abuse) of high-profile social media accounts other online presence owned by companies, political parties or individuals. Distributed Denial of Service (DDoS) is also a popular attack method. 
Less public, but equally effective, are personal trolling attacks on influential individuals, involving the theft of sensitive personal information for the purposes of blackmail or extortion.
Targets can be very diverse – for example, Anonymous has recently ‘declared war’ on ISIS, claimed DDoS attacks on Turkish Banks, and compromised Icelandic government websites in a protest over whaling. 
While legitimate, law-abiding ‘physical-world’ activist groups that pursue protest but avoid breaking criminal law have used peaceful direct action, social media campaigns, protest and lobbying to make their case, the Activist does not feel constrained by the potential repercussions of activism in physical space, and their tactics reflect this.

Get in touch to talk with one of our experts, or download The Unusual Suspects Overview to find out more:

The Unusual Suspects Overview  Contact us


The Unusual Suspects overview

600.4 KB

12 Default Profile Image
Head of External Communications
Media Team
Digital Intelligence