A new analysis of over 11,000 posts from more than 120 hacktivist groups offers a clear picture of politically motivated cyberattacks in 2025. The research highlights that modern hacktivists prioritize high-visibility, easy-to-execute operations over complex, stealthy intrusions. Their primary goal is to amplify their message and cause disruption on a global scale, targeting organizations far beyond specific geopolitical conflict zones.

The Public Command Center

Contrary to the image of shadowy figures on hidden forums, today’s hacktivist campaigns are largely organized in plain sight. Telegram has emerged as the undisputed command center for these groups, serving as the main platform for planning attacks and issuing calls to action. The social media platform X (formerly Twitter) follows as the second most popular venue. This open-channel approach allows groups to maximize their reach and recruit participants for campaigns that span Europe, Asia, and the Americas.

Hashtags as Digital Weapons

Hashtags are the lifeblood of these operations, acting as more than just labels. They function as political slogans, tools for coordinating activity, and a way for groups to claim credit for attacks. Analysis of over 2,000 unique tags in 2025 shows that while most are short-lived, they provide valuable intelligence. Reports of completed attacks dominate this hashtagged content, with Distributed Denial-of-Service (DDoS) attacks being the preferred method by a wide margin (61%). While threatening posts don’t always guarantee an attack, those that are published often precede action within the same week or month, making real-time monitoring a crucial defensive strategy.

Source: https://securelist.com/dfi-meta-hacktivist-report/117708/