ZeroFox Intelligence Brief - Hacktivism: Tactics, Techniques, and Procedures

ZeroFox Intelligence Brief - Hacktivism: Tactics, Techniques, and Procedures

Product Serial: B-2025-09-04a

TLP:CLEAR

In this Intelligence Brief, ZeroFox researchers report on hacktivism-focusing on the tactics, techniques, and procedures used by modern-day hacktivists.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• Hacktivist collectives are motivated by an array of incentives ranging from perceived persecution to the pursuit of transparency, justice, or systemic reform. Hacktivists are typically politically, socially, or ideologically motivated.
• Although hacktivists are most often driven by political, social, or ideological motivations—matters that do not usually draw state entities into offensive cyber activity—state-affiliated collectives are aligned with national interests to some extent through a shared ideology, informal coordination, or direct sponsorship.
• Hacktivists use a variety of methods to achieve their desired end state, which are collectively referred to as their tactics, techniques, and procedures (TTPs). They employ a wide range of TTPs, which can be attributed to disparity in expertise, available resources, risk appetite, and technical knowledge, all of which vary significantly across collectives.
• In response to geopolitical events and growing tensions, hacktivist collectives often form alliances with other collectives that share perceived injustices underpinned by ideological, religious, political, or national beliefs.