What Is Hacktivism

By Muhammad Raza January 12, 2024

Not every cybercrime is about, well, the crime. In fact, some attacks are designed to draw attention to a cause, not stolen data or paydays.

Social activism has been around forever. Today, it can manifest in the physical world, of course, and increasingly we see social activism in the digital world, too, ranging from minor activist activities all the way to high-profile cybercrime incidents.

The highest-profile of these activities - actual cybercrime - mark the desire to disrupt the status quo as a means to effect and control digital spaces, and in turn, instigate desirable outcomes in the physical world. These actions can involve unauthorized access, control or service disruption of digital resources that belong to a notable entity, all by means of hacking.

What is hacktivism?

A portmanteau of the words hack and activitism, the term 'hacktivism' refers to hacking activities performed in the digital world (cyber space) in order to achieve social or political objectives. The targets of hacktivism typically include:

• Government authorities
• Technology companies
• Financial groups
• Interest groups or entities
• Individuals

Hacktivism may be triggered by a standalone event, incident or a policy enforcement that potentially breaches the rights, sentiments or opinions of a mass audience.

Hacktivists take the initiative on the behalf of a perceived aggrieved audience, carrying out hacking activities "on their behalf". Hacktivism requires access to computing resources - such as botnets for DDoS attacks and virus packages for zero-day exploits - and advanced hacking skills.

(Related reading: ethical hacking.)

Hacktivism differs from traditional activism

Many true activists are quick to point out the notable differences between activism and hacktivism:

Geography, scale, group size

Traditional activism is concentrated geographically, as most breaches of a group of people rarely scale beyond their geopolitical situation. The scale is highly dependent on the number of participants. In fact, many activists consider a movement sufficiently vocal only when enough people gather to capture the attention of traditional news outlets. Two important attributes of traditional activism are the number and voice:

• How many people can gather to protest.
• How vocal they can be.

Though activism includes many actions beyond protesting, peaceful protesting can be a meaningful part of social movements. Indeed, a small number of protests achieve impact through some form of resistance or vandalism.

Digital activism, and especially hacktivism, relies heavily on the skill and ability of a hacker to produce an impactful cyberattack that can communicate the desired message across to the wider awareness as well as the status quo and concerned authorities.

Hacktivism may not be a bottom-up approach. In fact, a successful hacktivist attack may instigate both:

• Mass protests in the digital world across social media channels.
• Public demonstrations in the physical world.

The nature of such protests in the digital world may be global and diversified, and arguably, more vocal than a concentrated traditional protest that occurs locally in the physical world.

Action and response

Another key differentiation is that hacktivism embodies immediate action. In 2011, the popular hacking group Anonymous launched Operation Tunisia against the government's censorship and laws against free speech.

In 2010, decentralized coordinated DDoS attacks were launched by similar groups to protest actions against Wikileaks. This was part of the Operation Payback hacktivism campaign against major financial and digital companies that blocked services to Wikileaks.

Goals of digital activism

Yes, those hacktivists may have been unable to achieve their desired outcomes of revolutionary overhaul of the political sphere and the economic status quo. Still, digital activism frequently achieves the following objectives:

• Amplified emotional outcomes from a large audience that shares a desire for the commanded objectives.
• Mass participation from an average social media user with minimal effort, as compared to physical protests.
• Directed (cyber) attacks that more frequently overcome the defense mechanism adopted by notable entities such as government organizations, financial institutions and tech companies.
• Leak of sensitive information and evidence that may not be public knowledge but can serve as a driver for public sentiment toward a particular political movement.
• Countermeasures on behalf of victims in the form of improved cybersecurity defense measures and policies.

How hacktivists engage in digital activism

The most common mechanisms center around information leaks, data breaches, or service disruption. Hackers might:

• Compromise a vulnerability in the private networks of a victim to gain privileged access and compromise sensitive business information.
• Use compromised credentials to publish a desired message on their website, locking out other users from making a change.
• Access sensitive information and resources and leak them on public forums.

Another common approach is to execute a DDoS attack on the target servers. A DDoS attack overwhelms the target server with global traffic from thousands of bots, which renders the service unavailable for legitimate users during the attack.

Hacktivists may employ services from cybercrime underground rings where botnet services are available for hire and sold for a service - something like hacking as a Service model.

(Related reading: ransomware attack trends & ransomware types.)

How organizations can prevent hacktivism

And what can organizations do about hacktivism? As a first step, it is important to understand that hacktivism is not the same as online activism.

Recognize legal activism vs. illegal activism

Digital and online mediums serve as a platform for both activities. In some cases, both may even aim for a similar goal. The approach in each scenario, however, is vastly different. Hacktivism has its roots in cybercrime and uses illegal means to realize the desired impact. Online activism does not.

Harden your cyber defense strategies

Your cyber defense strategy against hacktivism may follow the standard industry best practice guidelines:

• Encrypt sensitive information.
• Adopt strong Identity and Access Management (IAM) controls.
• Establish a business continuity plan and disaster recovery strategy.

Users should be encouraged to follow guidelines that prevent phishing, social engineering, careful handling of data on personal devices and using multi-factor authentication systems.

Likely targets of hacktivism

Government organizations, utility service providers, financial institutions and large tech companies are likely targets of hacktivism. This is primarily because they reach a wide audience and any attack on popular services is likely to gain the most public attention - which may spurn a response.