GCHQ reportedly infiltrated and attacked hacktivist groups

Leaked documents suggest the agency used denial-of-service tactics and assisted law enforcement in identifying Anonymous members

British intelligence agency Government Communications Headquarters (GCHQ) has reportedly infiltrated hacktivist groups and used denial-of-service and other techniques to disrupt their online activities.

A PowerPoint presentation that GCHQ prepared for a 2012 conference organized by the U.S. National Security Agency reveals that one of the agency's units, called the Joint Threat Research Intelligence Group (JTRIG), collected information on "hacktivists" -- politically motivated hackers -- and shared it with law enforcement agencies. The unit also used denial-of-service techniques to disrupt the hacktivists' communication channels.

The slides were among the documents leaked by former NSA contractor Edward Snowden and were published Wednesday by NBC News. JTRIG used human intelligence techniques to gather information about members of Anonymous and LulzSec, two related groups of hacktivists that attacked the websites of various companies, organizations and governments, NBC News reported.

The leaked slides provide two examples of JTRIG intelligence gathering that targeted two hackers using the online handles GZero and p0ke.

In one IRC (Internet Relay Chat) log included in a slide, an undercover JTRIG agent responds to a request from a hacker looking to buy access to a website with 10,000 or more unique daily visitors. The discussion suggests the hacker intended to install an exploit on the site to infect the computers of visitors with botnet malware so they could be used to support Operation Payback, a large-scale DDoS (distributed denial-of-service) campaign launched by Anonymous in 2010 against pro-copyright organizations and a variety of companies including PayPal, MoneyBookers, Visa, Mastercard and Amazon.

In another chat log, the agent is contacted by a user named GZero who says the first hacker works with him and who also expresses interest in buying traffic for use with an exploit pack.

JTRIG's reporting on GZero led to his identification and arrest, one of the slides says. Edward Pearson, a 23 year old from York, England, was identified by law enforcement as GZero. He was sentenced in 2012 to two years in prison for using Trojan programs like Zeus and SpyEye to steal credit card details and PayPal credentials.

Another chat log in the GCHQ slides shows a user named p0ke telling another one, named Topiary, that he hacked into a government database and extracted the names, email addresses and phone numbers of 700 U.S. Federal Bureau of Investigation employees. In a later private chat with a JTRIG agent p0ke says that he compromised usda.gov, the website of the U.S. Department of Agriculture.

P0ke was identified by JTRIG, but was never arrested for hacking into government databases, NBC News reported. However, an 18-year-old teenager from Scotland named Jake Davis was identified as Topiary and was arrested in 2011. He later pled guilty to computer related crimes and was sentenced to 24 months in a youth detention center.

The GCHQ slides also mention an operation code-named Rolling Thunder that disrupted an Anonymous IRC server by using denial-of-service techniques. One chat between Anonymous supporters included in the slides suggest the server was hit by a SYN flood -- a type of denial-of-service attack involving a flood of SYN requests -- which resulted in downtime of over 30 hours.

JTRIG agents also sent messages that read "DDOS and hacking is illegal, please cease and desist" to Anonymous supporters via Facebook, Twitter, email, Skype and other instant messaging applications, NBC News reported, citing a slide that is not among those published. The outcome of this type of activity, which GCHQ calls "information operations," was that 80 percent of those messaged did not show up in Anonymous' IRC channel one month later.

Join the CSO newsletter!

Error: Please check your email address.

Tags Government use of ITNational Security Agencyonline safetysecurityGovernment Communications HeadquarterslegalspywaregovernmentprivacyCriminal

More about Amazon Web ServicesDepartment of Agriculture, Fisheries and ForestryFacebookFederal Bureau of InvestigationGCHQMastercardNational Security AgencyNBCNSAPayPalPearsonSkypeVisa

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts