You know, usually when we picture a high stakes
bank heist, the robbers are wearing ski masks.
Right. They're dressed in all black. Exactly.
The entire point is to be invisible, right? To
be a shadow and leave absolutely zero trace of
their actual personality behind. Yeah, because
anonymity is, well, it's the primary defense
mechanism for any illicit activity. The less
of yourself you reveal, the safer you are from.
leaving a forensic trail. But imagine if instead
of a ski mask the bank robber kicked the door
down wearing like a neon pink mascot suit. Oh
man. And instead of just silently handing over
a bag for the vault cash They demanded the teller
sing a pop song, broadcast the whole thing on
a live stream, and then, I don't know, handed
out flyers detailing their personal, highly polarizing
political opinions. See, in that scenario, you
wouldn't know if you were dealing with a criminal
mastermind, a political extremist, or just someone
playing a massive, highly illegal prank. Right.
The threat models we use to predict behavior,
they completely break down when an attacker doesn't
act rationally. And that tension, that bizarre
contradiction, is what we are exploring in today's
Deep Dive. We're unpacking the incredibly chaotic
two -year lifespan of a black hat hacktivist
organization known as SiegedSec. It is a wild
timeline. It really is. So we've got a comprehensive
stack of sources in front of us today anchored
by a detailed Wikipedia article to trace exactly
how this group operated between early 2022 and
mid 2024. Yeah, we're looking at a wildly unconventional
intersection of internet meme culture, highly
sensitive cybersecurity breaches, and intense
ideological warfare. Which is just such a strange
mix. It really forces you to rethink what a modern
cyber threat actually looks like. Absolutely.
It moves us away from that classic idea of state
-sponsored hackers in dark rooms and toward highly
decentralized, culturally motivated internet
subcultures. Yeah. But before we jump into the
timeline, though, we need to set some ground
rules for this deep dive. Very important. Because
the source material we are covering today contains
highly politically charged content. I mean, SiegeSec
targeted organizations on both the left and the
right sides of the political spectrum. We were
all over the map. They were. We are talking about
everything from debates over gender -affirming
care legislation to international military conflicts
in the Middle East to conservative political
think tanks. So it's heavy stuff. Exactly. So
to you, our listener, we want to be absolutely
clear here. We are going to impartially report
on the contents of this source material. We are
not taking any sides, and we are not endorsing
any of the viewpoints held by the hackers or
by their targets. Our mission here is strictly
to convey the factual events, the underlying
mechanisms of these hacks, and the ideas exactly
as they are contained in the original text. Because
in the world of cybersecurity analysis, adopting
an objective lens is really the only way to understand
the mechanics of an attack. Right. We have to
look at the data, the methods, and the stated
motives without validating the ideology behind
them. Okay, so let's unpack this. To understand
the damage seeds that caused, we first have to
understand who they claim to be. because it just
shatters that stereotype of the serious brooding
hacker. Oh, completely. So SiegeSec, which is
short for Siege Security, they emerged on the
messaging app Telegram in April 2022. Right.
They were led by a user going by the alias Veo,
along with other key members known as Cry. and
mirrorless, and they commonly self -described
as the gay furry hackers. Which is, I mean, it's
an intentionally disarming moniker. Yeah, it
sounds like a joke. Exactly, and Telegram acts
as a perfect incubator for this kind of subculture
because of its architecture. It offers encrypted
channels where users can be completely anonymous.
But it also feels like a social network. Yes,
it functions like a social media feed. It allows
for the rapid sharing of memes, inside jokes,
and hyper -specific cultural references right
alongside a highly technical exploit code. Wow.
So in the beginning, their motives seemed almost
entirely rooted in aggressive internet trolling.
Like, for example, in July 2023, they targeted
the University of Connecticut. The Yukon hack.
Right. The source notes, they used a vulnerability
in the university's listserv to send out spoofed
emails to undergraduate students. They falsely
announced the unfortunate passing of Rodenka
Marek, who is the university's president. Which
is just a massive disruption for a campus. Yeah.
Now for those who might not know, what exactly
is a listserv and how do you even weaponize it?
So a listserv is essentially a legacy automated
email broadcasting system. Universities use them
to send one message to thousands of students
at once. OK, so a giant mailing list. Exactly.
And if a system like that is outdated or misconfigured,
it might not properly verify who is actually
sending the email. Ah, I see. The hackers found
a flaw in that authentication process. They forged
or spoofed the sender's address to look like
it was coming from an official university admin.
And the system just bought it? Yep. The listserv
did the rest, distributing the fake death announcement
to the entire student body. That is crazy. And
when the Hartford Current newspaper interviewed
the leader, Veo, about this incident, Veo just
casually explained the technical vulnerability
and said they did it for the lots. Right, for
the lulz. It feels less like a traditional cybercrime
syndicate and more like a, I don't know, a weaponized
digital flash mob. They were hacking for the
punchline. That's a great way to put it. But
how does a group motivated by the lulz move from
a college prank to the kind of targets we see
next on this timeline. Well, the jump happens
because the psychology of a troll demands constantly
escalating shock value. Oh, sure. A fake email
gets boring. Exactly. It only gets you so much
attention. To keep the audience entertained and
to feed their own egos within these telegram
channels, they have to find bigger, more secure
doors to kick down. And they found some massive
doors. I mean, in February 2023, they hit Atlassian.
Yeah, that was a big one. Atlassian is a major
Australian software provider that builds tools
used by thousands of corporations globally. They
used stolen employee credentials to leak 13 ,000
employee records. But it wasn't just data. No.
They didn't just leak names and emails, they
leaked the physical floor plans for Atlassian
offices. Which crosses a very significant threshold.
How so? Well, you're moving from a purely digital
nuisance, like data theft, to enabling potential
physical security threats. Anyone with malicious
intent in the real world now has a literal map
of your corporate headquarters. That is terrifying.
The sources mentioned they used stolen credentials
for this. Does that mean they, like... guest
passwords or is there a more sophisticated mechanism
at play here? Usually this involves a technique
called credential stuffing. It's actually quite
crude but highly effective. Okay, how does that
work? Hackers buy massive databases of usernames
and passwords that were exposed in older, totally
unrelated breaches. Oh, because people reuse
their password. Exactly. Because people terribly
reuse the same password across multiple accounts,
the attackers use automated software to rapidly
test those old passwords on new targets, like
Atlassian's employee portals. It's not a brilliant
feat of coding. It's literally just jiggling
thousands of digital doorknobs until one happens
to click open because an employee reused a password.
That makes perfect sense. It's terrifyingly simple.
But SeedShack didn't stop at corporate software.
In 2023, they compromised NAO portals. Not once,
but twice. They leaked over 3 ,000 internal documents
from portals with very serious sounding names,
like the Joint Advanced Distributed Learning
Portal and the Logistics Network Portal. Right.
NATO actually had to publicly announce they were
investigating the breaches. No. You're probably
thinking what I was thinking when I read this.
Did a group of telegram trolls just steal nuclear
launch codes from a military alliance? Right.
It sounds catastrophic. Yeah. But not quite.
And this is a crucial distinction in understanding
modern cyber warfare. OK, break it down for us.
They didn't breach the classified air gapped
mainframes where active military operations are
planned. They breached third party portals, things
like unclassified training platforms or logistical
web forums. NATO is a massive bureaucracy. And
like any large organization, its outer perimeter
is full of smaller, less secure web applications
used for everyday administration. So the weakest
link isn't the military -grade encryption, it's
like the unpatched web forum used for a training
seminar. Precisely. It's a classic supply chain
or peripheral vulnerability. But still! Yeah,
the reputational damage is still immense. To
the public, a headline that reads NATO hacked
projects a narrative of weakness, which is exactly
the kind of chaotic publicity a group like SiegedSec
thrives on. Which brings me to the event that
I am genuinely struggling to wrap my head around.
Oh, the Idaho one. Yes. In November 2023, SiegedSec
hacked into the Idaho National Laboratory. This
is a massive U .S. federal research facility
dealing with nuclear energy. They compromised
the Oracle HR system and leaked personal employee
data. Yeah, let's break down the how on that.
An Oracle HR system is a massive database storing
highly sensitive personnel files, social security
numbers, home addresses, banking details for
payroll. So how do you even get into that? Breaching
it typically involves either finding an unpatched
software vulnerability, sometimes called a zero
-day flaw, meaning the software creator has had
zero days to fix it. Right. Or, more commonly,
a sophisticated phishing campaign that tricks
an HR employee into handing over their administrative
login. And once they have that data, they didn't
just dump it online. A few months later... In
February 2024, they literally mailed ransom payment
requests directly to the employees' physical
homes. That is a severe psychological tactic.
It obliterates the boundary between the digital
and physical worlds, tells the victim, we don't
just exist on your computer screen, we know where
your family sleeps. It is absolute psychological
terror. But then you read the actual ransom demand.
They didn't ask for millions of dollars in untraceable
Bitcoin. No, they didn't. They demanded that
the U .S. nuclear laboratory research creating
real -life cat girls. I have to push back here,
because how do these two realities coexist? How
does a group demanding anime tropes possess the
operational focus to navigate the cybersecurity
of a federal laboratory and terrorize its employees?
It's the ultimate paradox of modern cyber threats.
We tend to think of hacking groups as monolithic
entities where everyone is a hyper -focused mastermind.
Like in the movies. Exactly. But the reality
of these telegram -based groups is heavily decentralized.
You likely have one or two members who possess
genuine, highly specialized technical skills,
the ones actually exploiting the Oracle HR system.
But the cultural face of the group, the people
writing the ransom notes and demanding cat girls,
might just be the loudest most chaotic voices
in the chat room. Wow. The barrier to entry for
causing catastrophic damage is lower than ever.
One person with the right exploit can hand the
keys over to a dozen internet trolls. So the
technical tools to cause global panic are incredibly
cheap, but the motives remain entirely absurd.
But as we move through the source material, those
motives take a very sharp turn. Having established
they could breach major, highly secure networks,
SiegeSec began weaponizing those technical skills
for hyper -specific ideological warfare. They
launched hashtag op trans rights. Right. They
pivoted from the lulz to self -appointed moral
arbiters. Starting in June 2023, they targeted
U .S. government entities to protest bills restricting
gender -affirming care. Yeah, that was a major
shift. They leaked data from the city of Fort
Worth, Texas, the Nebraska Supreme Court, and
South Carolina police files. Then, in 2024, they
followed it up with hashtag OpTransRights2, where
they successfully breached and leaked data from
a conservative media outlet called Real America's
Voice and a church called River Valley Church.
And it wasn't just domestic U .S. politics either.
No. During the Gaza -Israel conflict, they intervened
on a geopolitical scale, attacking Israeli telecommunications
providers like BZEC, where they leaked info on
nearly 50 ,000 customers, and another provider
called CELCOM. The sheer breadth of the targeting
is staggering. They're inserting themselves into
incredibly complex, deeply entrenched cultural
and geopolitical conflicts, basically acting
as an unauthorized digital militia. It really
makes me wonder about the evolution of hacktivism
itself. Because when you look back at older groups,
like Anonymous, during their peak in the late
2000s, their targets felt very generalized. Right,
broad strokes. Yeah, it was a broad, sweeping
anti -establishment sentiment. The government,
big corporations, the Church of Scientology.
Sure. SiegeSec represents a shift toward hyper
-specific, highly polarized culture war flashpoints.
It's pinpointing exact legislative debates and
media narratives. Why the shift? Well, hacktivism
always mirrors the culture of the internet at
the time. A decade ago, the internet felt more
like a unified monoculture, so the targets were
broad. That makes sense. Today, we live in highly
fragmented, algorithmically driven bubbles. Trolls
eventually get bored of just causing chaos. They
crave moral justification for their actions.
Right, they want to feel like the good guys.
Exactly. So these groups adopt the hyper -specific
language and grievances of niche micro communities.
They aren't trying to appeal to the global masses
like Anonymous did. They are trying to be heroes
to their specific curated telegram audience.
And to amplify that power, they started forming
alliances. The outline lists a dizzying array
of collaborations. They worked with a group called
Anonymous Sudan for the attacks on Israeli infrastructure.
They shared anti -NATO motives with a group called
KittenSec. They even helped form a larger syndicate
called Five Families, teaming up with groups
like Ghost Security and Stormous Ransomware.
The Five Families moniker is an obvious nod to
the American mafia, showing they were fully leaning
into the theatricality of organized crime. Oh,
totally. But the mechanics of these alliances
are very different from traditional syndicates.
Let's dig into those mechanics. Are these groups
merging their leadership, or is it more informal?
It's highly ephemeral. Think of it less like
a corporate merger and more like a digital pop
-up shop. A digital pop -up shop. I like that.
Yeah. You have disparate groups operating in
the same dark web forums. One group might have
an access broker, someone who specializes in
stealing passwords but doesn't have the time
to sift through the data. They invite another
group into a temporary encrypted chat. They pool
their resources, launch a joint campaign for
a few weeks to maximize media coverage, and then
they delete the chat and vanish back into their
respective corners. It's fluid and opportunistic.
It's like a dark web of ventures. They just team
up for one mission and scatter. That's exactly
what it is. And sometimes those opportunities
allow them to play Robin Hood. The sources note
they partnered with hacktivists like BiteMeCrew
and the well -known hacker MeaArsonCrimeu to
expose stalkerware apps. Ah, yes, the TruthSpy.
Exactly, targeting a platform called the TruthSpy.
What exactly is stalkerware, and why would SiegeSec
target it? So, stalkerware is a deeply insidious
category of software. These are hidden applications
designed to be installed secretly on someone's
phone, usually by a domestic abuser. That's awful.
It really is. It monitors the victim's location,
reads their texts, and listens to their calls
without their knowledge. By hacking the companies
that create and sell this software, SiegeSec
was exposing the infrastructure of digital abuse.
It highlights that chaotic moral compass, right?
One week they're extorting nuclear lab employees
and the next week they're dismantling tools used
by domestic abusers. But the more noise you make
and the more alliances you form, the bigger your
footprint gets. Inevitably. Which brings us to
their final, most prominent political target.
In July 2024, SiegeSec announced they had breached
the conservative think tank, the Heritage Foundation.
A huge target. Massive. Specifically, they were
targeting them over the Project 2025 proposals,
which SeedSec released a statement on Telegram
labeling as an authoritarian Christian nationalist
plan. Which is a direct, ideologically motivated
strike against a highly resource, deeply influential
organization in Washington, D .C. The Heritage
Foundation immediately pushed back. A spokesperson
publicly dismissed the breach as a false narrative
and an exaggeration, claiming all their internal
systems remained completely secure. That is a
textbook crisis communications response. Really?
Oh yeah. Regardless of whether a breach is genuine
or exaggerated, the immediate goal of the victim
is to project strength and control the public
narrative, starving the hackers of the validation
they are seeking. Well, SiegeSec refused to be
ignored. To prove they were inside, they retaliated
by releasing chat logs. And not just any chat
logs. I know. These were private signal messages
between the SeedSec leader, VO, and a Heritage
Foundation executive named Mike Howell. Which
is just wild. And in those chats, Howell explicitly
states that he is working directly with the FBI
and that federal law enforcement is in the process
of identifying and outing members of your group.
That is the exact moment the digital wall shatters.
When you are communicating directly with an executive
who confirms that the FBI is actively building
a dossier on your physical identity, the illusion
of being an untouchable internet prankster evaporates
instantly. And the consequences of that realization
were immediate. On July 10th, 2024, right after
releasing those Heritage Foundation chat logs,
SiegeSec abruptly announced their total disbandment.
When stopped entirely and the reasons they gave
for disbanding are the most telling part of this
entire deep dive They didn't claim some grand
ideological victory They stated clearly that
they were disbanding for our own mental health
the stress of mass publicity and to avoid the
eye of the FBI This reveals the fundamental psychological
paradox of modern hacktivism. What do you mean?
Well, the internet provides incredible technical
armor. You can download software to mask your
IP address, you can use a cartoon avatar, and
you can operate on encrypted channels. It makes
causing global chaos feel like a video game.
Right. But there is no software you can download
to give yourself psychological resilience against
the federal government. It's the ultimate irony.
Here is a group that practically begged for mass
publicity. They wore the neon pink mascot suit.
They demanded cat girls purely for the memes.
But the moment they actually got the full undivided
attention of the real world, the moment the spotlight
actually hit them, the psychological pressure.
completely crush them. You simply cannot maintain
operational security when you are addicted to
virality. Wow. Yeah. The stress of managing that
double life, trying to be a normal person offline
while knowing you are a highly wanted cyber criminal
online is an immense unsustainable psychological
burden. The tools required to hack NATO are cheap
and decentralized, but the mental fortitude required
to withstand the FBI is not. OK, let's zoom out
and summarize this incredible timeline. Over
just two years, we watched SiegeSec emerge as
a group of self -proclaimed gay furry hackers
pulling basic email spoofing pranks on university
students. Right? From there, they rapidly escalated
to credential stuffing multinational software
companies, exploiting unpatched NATO portals,
and extorting nuclear laboratories with bizarre
anime demands. It's quite the resume. It is.
They then pivoted into hyper -polarized ideological
warfare. inserting themselves into domestic legislation
debates and international military conflicts,
forming ephemeral dark web alliances, until they
finally flew too close to the sun by poking a
major political think tank. And that drew the
direct ire of the FBI. Exactly. Causing them
to psychologically collapse under the weight
of their own notoriety. It is a remarkable case
study demonstrating how the democratized tools
of the internet allow incredibly noosh subcultures
to project real power on a global scale, but
also how fragile those groups are when forced
to face real world consequences. It brings us
back to that neon pink bank robber we talked
about at the beginning. The mask siege sec war
wasn't designed to make them invisible. It was
designed to make a statement. But the thing about
wearing a mask that bright is that eventually
everyone is going to look at you. And once they
start looking, they don't stop until they find
out exactly who is inside the suit. The mask
might protect your identity for a while, but
it cannot protect your peace of mind. Which leaves
us with a chilling final thought for you to mull
over today. We've seen that the tools to cause
massive disruption are cheap and widely available.
If a group primarily motivated by internet subcultures
and memes can successfully breach nuclear labs
and international defense networks, what happens
to the future of global cyber security? It's
a scary question. Will national defense agencies
eventually have to stop looking just for state
-sponsored military hackers and start profiling
niche internet fandoms to predict the next major
cyber warfare threat? It forces us to reconsider
entirely who and what constitutes a national
security threat. It certainly does. Keep diving
deep and keep asking the big questions.