CYBERSECURITYHacktivism Is an Underestimated Threat, Especially in Geopolitical Crises

By Stuart Crocker

Hacktivists, while individually unsophisticated, are collectively generating persistent disruption, particularly during geopolitical crises. Their impact is being amplified by a wider accessibility of tools, faster mobilization and alignment with real world events.

Cybersecurity experts and organizations need to take these actors much more seriously, detect their initial disruptions and treat those actions as precursors to more serious threats.

Since 2022, there has been a consistent surge in cyber activity during kinetic conflicts, geopolitical crises and regional tensions. Amid the ongoing Middle Eastern conflict, more than 149 hacktivist incident claims were recorded over a three-day period against governments, financial institutions, telecommunications and critical infrastructure.

Significantly, a large proportion of such disruption originates from loosely organized rudimentary cyber threat actors, known as hacktivists. These people, individually or in groups use hacking or disruptive cyber activity to promote a political, social, or ideological causes. An example in March in Australia was denial-of-service efforts linked to the Iran-Israel-US conflict and affecting a prominent Zionist foundation and Victoria Police.

The cybersecurity industry often dismisses hacktivists due to their informal communication style, lack of technical sophistication and long history of exaggerated claims. This is an analytical blind spot.

In detecting hacktivist disruptions, we can look out for some common characteristics. One is their informal communication methods. Also, they often have broken English, chant ad-hoc ideological slogans, conduct provocative messaging and post offensive memes. They make exaggerated claims of perceived compromise, which reduce their credibility. In February 2026, a pro-Russian hacktivist collective claimed access to an Australian wastewater treatment plant and irrigation management system, alleging they could manipulate pump readings and alarms without detection. Analysts should not dismiss these as clutter, noise or nuisance activity while solely focusing on high-end threats or advanced persistent threats. They should be aware that informality does not equal incapacity.

One reason to focus on informal activity is the surge in the availability of low-barrier, offensive capabilities online since 2022. These include denial-as-a-service platforms, public exploit kits, credential stuffing tools and open-source attack frameworks. Most problematically, using these tools and methods requires minimal technical skill. At the same time, hacktivists are improving their skills thanks to the increasing availability of generative AI.

These changes have resulted in a huge shift in threat modelling, and organizations now need to broaden their threat landscape horizons. They need to counter a surge in hacktivism as capability is commodified, participation surges, the barrier to entry lowers and the scale of activity increases.