Hacktivism Is an Underestimated Threat, Especially in Geopolitical Crises

Analysts should take note of the clear temporal alignment between geopolitical crises and surges in hacktivist activity. This pattern has been especially visible since February 2022 with the Russian and Ukraine conflict, which significantly increased the number of pro-Russian hacktivist groups targeting Ukrainian and allied infrastructure. This includes denial-of-service campaigns against government and critical services, website defacements tied to political messaging, data leaks framed as retaliation or ideological support, and recruitment drives for hacktivist collectives. These are driven by ideological alignment, nationalistic sentiment and opportunistic visibility. In these cases, hacktivists operate as ad-hoc digital militias mobilizing rapidly in response to events, showing that they are reactive, but predictably so.

This makes hacktivist monitoring an early-warning function. It could include tracking Telegram mobilization, campaign hashtags, target lists, denial-of-service claims, defacement posts and recruitment calls. These can all help identify likely targets before disruption occurs, allowing organizations to pre-position denial-of-service protection, harden exposed services, prepare communications and distinguish genuine compromise from inflated propaganda claims.

The challenge for observers is that the relationship between hacktivists and advanced persistent threats are shady at best. There is an indirect influence of narratives and target selection, opportunistic alignment with state interests and signal amplification of state-linked campaigns. This in turn adds volume and noise to the threat landscape, providing plausible deniability for state actors resulting in greater strategic effect. An example of this is a pro-Russian hacktivist group who claimed to support Russia’s position in Ukraine. A joint international advisory assessed that Russia’s GRU Unit 7445 likely supported its creation in 2022 and funded tools used by the group for denial-of-service activity until at least September 2024. The hacktivist group then used Telegram to organize attacks, claim responsibility for disruption against states supporting Ukraine, share ideological messaging, and publicize leaked information from hacks attributed to Russian state actors. Hacktivists are not advanced persistent threats, but they operate within an ecosystem shaped by advanced persistent threats.

Effect does not require deep compromise in the traditional sense but can include opportunistic intrusion, which sets conditions for potential digital footholds within target infrastructure. As we know, critical-infrastructure entities have a higher reliance on availability of their services, and, more often than not, they tune for sophisticated threats, not opportunistic mass disruption. But consequences of hacktivism can include erosion of public confidence, and operational degradation during sensitive time periods. Disruption at scale can rival more sophisticated intrusions and impact.

So how should cybersecurity experts, business owners, incident responders and risk owners respond? They need to consistently monitor open-source social media platforms, such as Telegram and X, to detect early indicators of mobilization and early-stage activity as a potential precursor, not noise. They need to threat-model beyond advanced persistent threat-centric frameworks and include mass participation scenarios and coordinated low-skill campaigns in what they prepare for. They need to integrate cyber and geopolitical intelligence in risk analysis processes.

More broadly, they should assume hacktivist disruptions will occur and priorities denial-of-service mitigation capabilities, redundancy, incident response speed and public communication readiness. Taking the hacktivist threat seriously requires a complete mindset shift.

The risk is not that these actors become more sophisticated, but that their simplicity, accessibility and scale continue to be underestimated. Cyber contestation should no longer be defined solely by elite operators but by the collective action of many.

Stuart Crocker is a cyber incident response and threat Intelligence practitioner in the Australian private sector. This article is published courtesy of the Australian Strategic Policy Institute (ASPI).