The Rise of Hacktivism: A Growing Threat to Companies and Governments

In today’s turbulent geopolitical climate, hacktivism is gaining traction among the threats faced by companies and public institutions

Thanks to collaboration with the FBI, the Spanish National Police have arrested a resident of Palencia who has been supporting two pro-Russian hacktivist groups in their malicious activities against Western organisations. It sounds like a movie synopsis that could straddle the line between a political thriller and a classic absurdist comedy, but it’s true.

This case allows us to shine a light on a key trend in the field of cybersecurity: the rise of hacktivism driven by the most turbulent geopolitical context since the end of the Cold War, in which armed conflicts intersect with growing political and commercial tensions among major powers.

Below, we’ll explain what hacktivism is, its objectives, the kinds of attacks it carries out, and how the convergence of hacktivism and advanced persistent threat (APT) groups can threaten organisations in critical sectors.

1. What Is Hacktivism?

The concept of hacktivism is self-explanatory enough to leave little to the imagination: hacktivist groups carry out malicious actions against companies and government agencies for political or ideological reasons.

What are they seeking to achieve? To gain notoriety and media exposure for their political demands, to damage the image of companies and institutions they consider enemies, to exfiltrate sensitive information, or to help destabilise rival states. In other words, unlike traditional cybercriminals, the goal of hacktivism is not to make a profit.

Hacktivism has also traditionally been distinguished from state-sponsored cyberespionage groups such as those from Russia, North Korea, or Iran. These groups have clear and ambitious objectives: stealing critical intellectual and industrial property, obtaining information that can be used in acts of war or sabotage, and damaging critical infrastructure…

For example, NoName057(16), one of the most notorious hacktivism groups in recent years, stated in its founding manifesto that its goal was to respond «to the hostile and openly anti-Russian actions of Western Russophobes», in direct reference to Western democracies’ support for Ukraine.

In fact, this group launched multiple DDoS attacks against Spanish organisations, including an attack on the website of the company responsible for the Leopard tanks in Spain—one of the weapons our country provided for Ukraine’s defence. Furthermore, it is important to note that this group carries out Operation #OpSpain, which has been activated and deactivated several times but has been active for over two years.

That said, you don’t have to go thousands of kilometres away to identify hacktivist groups. For example, in February 2026, the Spanish Civil Guard arrested the main members of Anonymous Fénix, a group that, since April 2023, had been launching DDoS attacks against Spanish political parties and public administrations, reaching its peak of activity following the DANA disaster in Valencia.

2. What kinds of attacks do hacktivists launch?

Indeed, hacktivism has been closely linked to distributed denial-of-service (DDoS) attacks.

DDoS campaigns seek to overwhelm digital services with a barrage of requests to prevent organisations’ websites from functioning normally or even to take them offline.

The goal of these attacks is to damage the reputation of companies and institutions and to ensure that their activities gain widespread attention and reach the public eye in their respective countries. In fact, NoName launched a DDoS attack against the website of the Ministry of the Interior on the day of Spain’s most recent general election, causing it to go down for several minutes.

Other types of attacks commonly launched by hacktivist groups include:

• Defacement. This is also an attack against a website, but in this case the goal is not to disrupt its operation; rather, the objective is to alter its appearance to make a statement or convey messages against organisations and governments. Another motivation behind this type of attack is to damage the reputation of a company or institution—or, on a more global level, that of a country.
• Data breaches at companies and institutions to gain public attention, through the exploitation of vulnerabilities, social engineering campaigns, or politically motivated ransomware attacks.
• Doxxing. That is, the public exposure of private information about individuals of interest or companies with the aim of harassing them.

These are attacks that can cause problems for the economy and public administrations, but they lack the complexity and impact of attacks carried out by large criminal groups.

However, hacktivism is beginning to emerge as a top-tier threat. Why? Armed conflicts are fueling an increase in hacktivist activity; their objectives are becoming more ambitious; and coordination with state-linked threat groups is increasing their capacity to cause harm.

3. Hacktivism has been fueled by armed conflicts

NoName, like other pro-Russian hacktivist groups, began its activities in the wake of the Russian invasion of Ukraine with the aim of destabilizing that country as well as its Western allies, but hacktivism also grew on the opposing side. Over the years, pro-Ukrainian groups have launched DDoS campaigns and attacks to spy on key Russian companies and institutions—such as its main drone supplier—to obtain confidential information of great geostrategic value.

But hacktivism has not been driven solely by the war in Ukraine; the Arab-Israeli conflict and the war in Iran have also led to a notable surge in hacktivism.

In the early days of the war in the Middle East, cybersecurity experts already detected a significant increase in hacktivism activities by pro-Iranian groups, such as Hydro Kitten, which focused on attacking the financial sector. Moreover, simultaneous hacktivism attacks against Middle Eastern states such as Israel, Kuwait, and Bahrain reached unprecedented levels.

In fact, when analysing the cybersecurity implications of the conflict in the Middle East, Tarlogic’s Cyber Intelligence team detected the presence of 84 active actors, most of whom were aligned with Iran.

In light of the rise in hacktivism, experts and public agencies responsible for cybersecurity recommend adopting strategies to counter hacktivist groups.

For example, Richard Horne, the executive director of NCSC, the United Kingdom’s national cybersecurity centre, warned in April that the country might have to face large-scale hacktivist attacks, which could have a level of sophistication and impact similar to that of serious ransomware attacks, such as those suffered by several British multinationals in 2025.

Why? According to Horne, Western public and private organisations find themselves in the midst of a perfect storm fueled by the technological revolution linked to AI and rising geopolitical tensions.

4. The Dangerous Convergence of Hacktivists and APT Groups

In addition to the factors highlighted by the NCSC, there is one key element: the growing connection between hacktivist groups and state-sponsored APT groups.

Historically, hacktivism has been summed up by the popular saying «much ado about nothing», given that its activity focused on launching DDoS campaigns to gain visibility, but without pursuing ambitious objectives.

In contrast, state-sponsored APT groups, such as Salt Typhoon (China) or certain Russian groups dubbed “Bear” by cybersecurity experts—such as Fancy Bear—have developed sophisticated, far-reaching attacks to carry out high-level cyberespionage operations.

While hacktivism has been driven by the will of the malicious actors involved, APT groups combine substantial financial and technological resources with advanced technical expertise.

The rise of hacktivism in recent years has not only led to an increase in the number of malicious actors and a higher level of complexity and ambition in their attacks but has also spurred collaboration between hacktivists and APT groups with common enemies.

The result has been the emergence of hybrid hacktivism, in which there is coordination and a transfer of knowledge and resources from state-sponsored groups to hacktivist groups, enabling them to carry out more complex and potentially damaging attacks. To the point that in some cases it is already difficult to distinguish whether malicious actors are hacktivists or state-funded groups aligned with their objectives.

In fact, CISA, the U.S. agency responsible for cybersecurity and infrastructure security, has linked the GRU, the Russian intelligence service, to pro-Russian hacktivist groups such as the Cyber Army of Russia Reborn (CARR), which is aligned with NoName, Z-Pentest, and Sector16.

5. Hacktivism Targets Critical Infrastructure and Sectors

Specifically, CISA and cybersecurity agencies and law enforcement agencies in other countries—such as Spain, France, Italy, the United Kingdom, and Australia—warned in late 2025 that these pro-Russian hacktivist groups were launching campaigns against critical infrastructure worldwide.

According to public authorities, the sectors targeted by hacktivism include water treatment and supply, food, and energy.

To these can be added other sectors critical to society and the economy, such as finance, telecommunications, and healthcare. In fact, the pro-Iranian hacktivist group Handala successfully attacked a multinational medical equipment and device manufacturer at the start of the war, causing a global disruption of its services.

Likewise, in recent years, hacktivist groups such as Z-Pentest have set their sights on industrial control systems (ICS), which are essential for the operation of highly automated industries and critical infrastructure such as power plants and water treatment facilities.

In fact, public authorities are warning about attacks against ICS systems and the operational technology (OT) of companies in critical sectors that are exposed to the internet and have low security levels.

Given what we have just pointed out, it is clear that hacktivism is no longer focused solely on carrying out traditional DDoS attacks against corporate or institutional websites, but has moved on to designing and executing more sophisticated attacks.

6. How to Address Hacktivism?

The rise of hacktivism has made it a significant threat, not only to the public sector but also to companies—especially those operating in critical sectors.

Therefore, it is essential that their cybersecurity strategies address the risk posed by hacktivism, especially in an increasingly unpredictable geopolitical context. What cybersecurity services can be key to preventing hacktivism? Ultimately, hacktivism is part of an increasingly complex and challenging threat landscape for both companies and public administrations.

• DoS test. Distributed denial-of-service tests simulate real attacks in controlled environments to assess the overload levels of an organisation’s internet-facing services and refine its capabilities to ensure resilience.
• Penetration testing services. Pentesters simulate attacks to identify vulnerabilities that malicious actors could exploit to cause corporate service outages, access confidential information, or install malware.
• Threat Intelligence. Targeted threat intelligence is key to identifying potential attack scenarios and taking measures to prevent the risk of security incidents.
• Red Team. Red Team operators simulate realistic attacks tailored to the attack scenarios identified by threat intelligence experts. This makes it possible to assess how an organisation responds to an attack by hacktivists or hybrid groups, train the professionals in charge of its defense, and optimize detection and response mechanisms.
• Proactive Incident Response. The ability to respond to an attack as quickly as possible, identify the scope of the compromise, and expel the malicious actor is essential to limiting the impact of an incident and safeguarding business continuity.

Ultimately, hacktivism forms part of an increasingly complex and challenging threat landscape for both companies and public authorities.

Armed conflicts and geopolitical tensions, the AI revolution, the blending of hacktivism and APT groups, and their intent to attack critical infrastructure are forcing organisations to adapt their cybersecurity strategies to counter attacks by malicious actors with political interests.