Signal in the Noise: What hashtags reveal about 2025 hacktivism in the Middle East
This study analyzes more than 11,000 hacktivist posts across surface and dark web sources and finds that most planning and mobilization happens in the open.
The targeting is global, extending well beyond MENA into Europe, the Americas, and Asia. Hashtags are the connective tissue of these operations, used as group identifiers, campaign tags, and claims of responsibility; they are posted constantly for coordination and visibility rather than stealth.
Hashtags also map alliances and momentum. We identify 2,063 unique tags in 2025 — 1,484 appearing for the first time, and many tied directly to specific groups or joint campaigns. Most tags are short-lived (about two months), with “popular” ones persisting longer when amplified by alliances; channel bans contribute to attrition.
Operationally, reports of completed attacks dominate hashtagged content (58%), and within those, DDoS is the workhorse (61%).
Spikes in threatening rhetoric do not by themselves predict more attacks, but timing matters: when threats are published, they typically refer to actions in the near term, i.e. the same week or month, making early warning from open-channel monitoring materially useful.
The targeting is global, extending well beyond MENA into Europe, the Americas, and Asia. Hashtags are the connective tissue of these operations, used as group identifiers, campaign tags, and claims of responsibility; they are posted constantly for coordination and visibility rather than stealth.
Hashtags also map alliances and momentum. We identify 2,063 unique tags in 2025 — 1,484 appearing for the first time, and many tied directly to specific groups or joint campaigns. Most tags are short-lived (about two months), with “popular” ones persisting longer when amplified by alliances; channel bans contribute to attrition.
Operationally, reports of completed attacks dominate hashtagged content (58%), and within those, DDoS is the workhorse (61%).
Spikes in threatening rhetoric do not by themselves predict more attacks, but timing matters: when threats are published, they typically refer to actions in the near term, i.e. the same week or month, making early warning from open-channel monitoring materially useful.
Fornitore: Kaspersky | Dimensione: 6,57 MB | Lingua: Inglese