Hacktivism Watch: The Biweekly Pulse | September 16-30, 2026

Executive Summary

Between September 16 and 30, 2026, we tracked 383 attack records from ten hacktivist and DDoS-for-hire actors. They split into 322 DDoS claims (84%), 55 defacements (14%) and 6 alerts (2%). DDoS is the baseline activity for almost every group.

Our main findings:

Introduction

Hacktivist collectives announce attacks openly, publish "proof" through Check-Host reports and use Telegram for coordination and propaganda. This edition limits scope to three observable categories:

We cover ten actors: NoName057(16), Dark Storm Team, RBL LEVIATHAN GHOST, Elite Squad, Trxsl7Stresser Proof, StarPez, Team1914_official, QX-CYBER, Server Killers and GORZ ROSTAM. The goals are to assess what the activity means, identify tools and capabilities, map connections between actors, and give defenders actionable guidance. Claims are unverified unless stated, and capability statements for tools are our assessment, not confirmed analysis of the tools.

Activity Snapshot

Ranking is by DDoS volume. By total records, Elite Squad (57) and QX-CYBER (54) rank higher than their position here.

Key Findings

1. Three tiers of actor, three different goals.

2. European waves mirror each other. NoName057(16) and Dark Storm Team both hit Bari, Reggio Emilia, Arzignano and the ports of Civitavecchia and Augusta, as well as Kharkiv Machine Building Design Bureau, Ferrexpo, Photoprylad and OM Brand. They also hit Czech government sites on Sep 28–29. We assess this as a shared target list or one group following the other. This is an inference, not proof of coordination.

3. Defacement is largely opportunistic in victim selection. QX-CYBER's defacements are mostly schools, many on thai[.]ac domains, which points to a shared hosting or CMS weakness. Elite Squad's are small businesses and associations in Turkey and Germany. GORZ ROSTAM's are free-hosted or commercial sites, not Israeli institutions. 

4. Proof culture drives the numbers. Nearly every actor posts Check-Host reports. A single Check-Host report can cover several URLs, so counts based on posts can overstate unique victims.

5. Sector pattern. Government dominates DDoS. Education dominates defacement. Transport, defense, energy and finance follow, especially in the European campaigns.

Threat Actor Profiles

1. NoName057(16)

Overview. A DDoS-focused actor and the most active actor this period (79 DDoS claims, no defacements or alerts). Its targeting during the period centered on countries and organizations associated with support for Ukraine.

DDoS Activity. The campaign rotated by country: Germany (Sep 17–20), Italy (Sep 21–27), then Czechia (Sep 28–30), with Ukrainian targets throughout. A typical day mixed government, transport and defense sites.

Defacement and Alerts. None recorded.

Tools and capabilities. No DDoS tool name is disclosed. Check-Host is used as the validation method.

Targeted Sectors:

Targeted Countries:

2. Dark Storm Team

Overview. A DDoS actor first seen in August 2023, with 49 DDoS claims and no defacements or alerts.

DDoS Activity. It followed the same Germany → Italy → Czechia pattern as NoName057(16), plus US platforms. Examples are Bluesky, DoorDash, 4chan, Robinhood and i3 Broadband.

Tools and capabilities. No framework is identified. Capability is limited to website-layer disruption validated by outage reports.

Targeted Sectors:

Targeted Countries:

3. RBL LEVIATHAN GHOST

Overview. An Indonesian-led actor with 41 records (39 DDoS, 2 defacements, no alerts). It acts as the hub of a large multi-group alliance, and it also sells DDoS capacity.

DDoS Activity. Targets were scattered globally and tied to the actor's campaign hashtags (#OpSzionis, #OpThailand, #OpJapan, #OpIndia).

Defacement Activity. Two defacements: Pientka GmbH (Germany) and Celebs Kingdom. Allied "Hacked by CYBER TEAM INDONESIA" posts appear in the same channel, including a Bangladeshi university's subdomains.

Tools and capabilities. On Sep 30 the group advertised "DDoS tools" for sale at about USD 100 and DDoS services billed by the minute or hour, including sustained attacks ("holding") and domain takedowns. The tool name is not disclosed. One post uses an ".h2" method label. See the tools table below.

Targeted Sectors:

Targeted Countries:

4. Elite Squad

Overview. An Arabic-language actor allied with DieNet, with 57 records (39 DDoS, 15 defacements, 3 alerts), the broadest mix of the ten. Its posts include Palestine-related messaging and attacks against Gulf, Israeli and other targets.

DDoS Activity. It claimed 14 UAE government systems on Sep 24 (including Ma'an, Abu Dhabi Mobility, the Ministry of Justice and the Sheikh Zayed Grand Mosque Centre), 12 Saudi government sites on Sep 30, and an "experimental wave" against Israeli sites on Sep 25 that promised more. Earlier, on Sep 12, it announced a first run of its own stresser against Moroccan government sites.

Defacement Activity. Fifteen defacements in three batches:

The targets are small businesses, associations and a church group, not political institutions. We assess these as opportunistic mass defacements through a web vulnerability or upload bypass, credited in channel posts to members using the handles "Alnaaze 757" and " Mr.ZeroDay0x00 ".

Alerts. Three claim-stage alerts: the Moroccan government (Sep 19, the same day as its "Wave VII" Morocco-themed post), "taminat.gov" (Sep 23) and Iraq (Sep 29).

Tools and capabilities. "Elite Squad Stresser" (first run Sep 12), upload and WAF-bypass kits, and a Telnet scanner workflow (Sep 26) for finding Telnet-exposed devices to recruit into a command-and-control botnet. Details are in the tools table.

Targeted Sectors:

Targeted Countries:

5. Trxsl7Stresser Proof

Overview. A commercial DDoS-for-hire "proof" channel (29 DDoS claims, no defacements or alerts). Its posts follow a fixed template listing host, method, concurrents, Check-Host report and a "BuyPlans" link.

DDoS Activity. A steady flow of attacks on Indonesian sites, plus global brands. A bot posts "Attack Sent!" confirmations with target, duration (for example 200 seconds), ISP and active servers.

Tools and capabilities. Branded methods trxsl7-browser, trxsl7-bypass, h1-trxsl7, plus TLS, PRIV, R12 and NET. See the tools table.

Targeted Sectors:

Targeted Countries:

6. StarPez

Overview. An Indonesian-language DDoS-for-hire service (22 records: 21 DDoS, 1 defacement).

DDoS Activity. Posts alternate between named-method showcases and "ATTACK BY BUYYER" posts (attacks ordered by customers). It also advertises a "News takedown" service, claiming that content was removed from the web for a government-linked client.

Defacement Activity. One: the National Institute of Cardiovascular Diseases (Bangladesh), attributed to the BNCT_1360 channel, an RBL alliance member. This links StarPez to the same ecosystem.

Tools and capabilities. Methods .net, .mix, .h2-bot, .h2-pez, .h2-bypass, .https, .browser and .storm, plus a "StarPez Bot DDoS" product.

Targeted Sector:

Targeted Countries:

7. Team1914_official

Overview. A multi-country actor with 23 records in the activity snapshot (21 DDoS, 1 defacement, 1 alert).

DDoS Activity. Israel-related targets included Yad Vashem, the Israel Democracy Institute, the Prime Minister's website, the National Open Data Portal and the Israeli embassy site in Bahrain. It also hit Germany's Federal Intelligence Service and Polizei Rheinland-Pfalz, Slovakia's Ministry of Interior, Statistics Estonia, the Estonian Internet Foundation, Global Affairs Canada, Ma'an (UAE), US platforms (Travis CI, DoorDash) and Indian targets (Indian Trade Portal).

Defacement and Alerts. One defacement (Dogmax, Sep 26). One alert: a claimed intent to target the Kimi AI service (Sep 19).

Tools and capabilities. None identified.

Targeted Sectors:

Targeted Countries:

8. QX-CYBER

Overview. A Thailand-focused actor with 54 records (19 DDoS, 33 defacements, 2 alerts). Its posts, in Khmer and English, frame the activity as war against Thailand, and it is the main voice of Operation Anajak.

DDoS Activity. Targets included the Thai Bankers' Association, Bank for Agriculture and Agricultural Cooperatives (BAAC), Krungsri, ThaiCERT, THNIC, Airports of Thailand, Thailand Cyber University, hosting providers, a hospital and Chulalongkorn University.

Defacement Activity. 33 defacements, with timing as the standout feature: 13 on Sep 19 and 11 on Sep 20. Then it dropped to 4 on Sep 21 and trickled through Sep 25.

By category:

The burst on shared-looking school domains suggests one reusable weakness exploited at scale, then a pivot on Sep 21 toward higher-value targets (the Army, then banks and the CERT). This is our assessment of the sequence.

Alerts. Two: websites (Sep 19) and "multiple industries in Thailand" (Sep 27), each announcing intent ahead of or alongside waves.

Tools and capabilities. Check-Host proof, mass defacement ("Deface by Nexusec (MASS DEFACE)"), a "CHECKER TOOL" (function not stated) and the coalition's branded DDoS tool from the June edition (NXBBSEC / "ATTACK SCOT v1.0"). Credentials for Thai portals were posted in some defacement posts, which hints at stolen or weak logins as an access route. We have not reproduced them.

Targeted Sectors:

Targeted Countries:

9. Server Killers

Overview. A focused DDoS actor with 14 records, mainly against Norway. Activity is concentrated in the first part of the reporting window.

DDoS Activity. Targets included the Norwegian Intelligence Service, BankAxept (card payments), Finn.no (a marketplace), several Norwegian ministries (dio.dep.no, dss.dep.no and others), the Central Bank of Romania, EFTPS, Science.gov and DOE OSTI in the US. Posts state outage durations (1–5 hours) and promise more intense attacks on Norway after a government announcement supporting Ukraine.

Tools and capabilities. No tool is named. In an earlier post, the group describes starting at Layer 4 and switching to Layer 7 when the target began blocking its bots. That indicates botnet use and attack adaptation.

Targeted Sectors:

Targeted Countries:

10. GORZ ROSTAM

Overview. An actor focused primarily on Israeli targets, with 15 records (12 DDoS, 3 defacements). Its channel also published anti-Israeli and anti-US messaging.

DDoS Activity. Targets were Israeli institutions: Israel Discount Bank, Campus IL, XTEND, MATAM Technology Park, INSS, IIBR, Israel Diamond Exchange, University of Haifa, Israel Ports Company and ISDE. A Sep 22 "September DDoS Update" claimed recurring attacks and mocked the targets' security upgrades.

Defacement Activity. Three: RealHomes (Sep 29), subdomains of the free hosting service kesug[.]com (Sep 19) and VCity88 (Sep 16). These are commercial or free-hosted sites with no Israeli connection. Defacements were mirrored on Zone-H and Defacer[.]id. On Sep 17 the group also published a list of third-party pages named "GORZROSTAM.html", which looks like a batch of compromised sites hosting its banner.

Tools and capabilities. No DDoS tool is named. Evidence is Check-Host proof and defacement mirrors.

Targeted Sectors:

Targeted Countries: 

CyberXTron Assessment

The observed activity was driven by a mix of geopolitical targeting, commercial DDoS activity, visibility and capability demonstration, and audience-building. DDoS campaigns ranged from Ukraine-related targeting by NoName057(16), Dark Storm Team and Server Killers to Thailand-focused activity by QX-CYBER, while Trxsl7Stresser Proof, StarPez and RBL LEVIATHAN GHOST showed patterns consistent with service promotion and customer-driven activity. Defacements were primarily used for scale, branding, publicity and recognition, with QX-CYBER's large school-site wave and Elite Squad's milestone- and feud-linked campaigns standing out. Alerts mainly served as indicators of intended targeting and psychological pressure; QX-CYBER's alerts aligned with later activity, while other alerts had weaker follow-through. Overall, the activity reflects disruption, publicity, service promotion and signaling rather than a single unified operational objective.

DDoS Tools, Methods and Services Observed

Tool names below are limited to explicitly named methods and products. Where no named DDoS tool is identified, the report says so. Capability descriptions are assessments based on naming and observed outcomes, not independent tool testing.

Defacement-related tooling. Elite Squad credits "bypass" kits to its members (Alnaaze 757, Mr.ZeroDay0x00). QX-CYBER's "Mass Deface" posts point to scripted bulk defacement. GORZ ROSTAM uses Zone-H and Defacer[.]id to publicize results.

Capability note:

Common Hashtags and Actor Overlap

Actor-specific tags: Elite Squad uses #النخبة, #نازي, #زيرو and #Elite_Squad. Server Killers uses #ServerKillers. GORZ ROSTAM adds #DeathToImperialism. Trxsl7Stresser and StarPez use no hashtags.

Connections and Correlations

Telegram Channels and Communication

Recommendations

1. Report incidents promptly

2. Deploy layered DDoS protection

3. Protect public websites against defacement

4. Audit applications before and after going live

5. Strengthen authentication and access control

6. Keep systems patched and the attack surface small

7. Secure the network and endpoints

8. Back up and recover

9. Manage supplier and hosting risk

10. Prepare for incidents and monitor continuously

11. Use threat intelligence and early-warning signals

12. Adopt zero trust and train people

Conclusion

This fortnight reflects a diverse but highly concentrated hacktivist landscape, ranging from European DDoS campaigns and Thailand-focused operations to commercial DDoS-for-hire services and opportunistic defacement activity. Repeated targeting, country-based attack waves, and shared campaign activity indicate a strong emphasis on disruption, visibility, and short-term impact rather than sustained intrusion. Overall, the fortnight was defined by high-volume DDoS activity, burst-driven defacements, and a smaller number of alerts indicating potential future targeting.