RipperSec
RipperSec is classified as hacktivist.
- Malware families
- 1
- Origin
- Malaysia
RipperSec is a pro-Palestinian, likely Malaysian hacktivist group created in June 2023, known for conducting DDoS attacks, data breaches, and defacements primarily targeting government and educational websites, as well as organizations perceived to support Israel. The group has claimed 196 DDoS attacks, with a significant portion directed at Israel, and utilizes a tool called MegaMedusa for their operations. RipperSec operates on Telegram, where it has amassed over 2,000 members, and collaborates with various like-minded hacktivist groups. Their attack strategy relies heavily on community involvement rather than sophisticated infrastructure.
The group's reported origin is Malaysia.
The group is associated with 1 malware families.
The group is associated with 1 malware families.
Malware families
- megaMedusa
Published reports on this actor:
- https://blog.checkpoint.com/security/hacktivists-call-for-release-of-telegram-founder-with-freedurov-ddos-campaign/
- https://www.radware.com/blog/security/2024/08/megamedusa-rippersec-public-web-ddos-attack-tool/
- https://www.cyjax.com/the-hacktivist-response-to-uk-foreign-policy/
Source: MISP Galaxy, Malpedia.
What does a hacktivist do?
Hacktivist groups choose targets based on political and current events. Denial-of-service (DDoS) attacks, website defacements and publication of stolen data are common; announcements are made on Telegram channels.
Which defenses matter most?
- Use denial-of-service protection and a content delivery network for your website and APIs.
- Keep your content management system and plugins updated, and do not expose the admin panel to the internet.
- Monitor announcement channels: target lists are shared before attacks.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.