Signal
in the Noise
What hashtags reveal about
2025 hacktivism in the Middle East
What do hacktivist campaigns look like in 2025?
We analyzed more than 11,000 posts containing hashtags — nearly 20% of all hacktivist content we traced
across channels from over 120 groups in 2025.
Our analysis revealed:
How hashtags are used to coordinate attacks or claim credit
The types of cyberattacks being promoted or celebrated
Patterns across campaigns and regions
How long it typically takes for attack to be reported after the initial threat post
Top 5 new hashtags in 2025
We identified 2,063 unique hashtags used in hacktivist publications so far in 2025. Of these, 1,484 are new, with their first appearance this year.
Hacktivists typically use hashtags in their messages associated with several contexts:
Reports on completed attacks
- DDoS
- Defacement
- Data breach
- Doxing
- Credential leaks / access disclosures
- Network infrastructure reveals
- Uncategorized attacks
Upcoming attack warnings -
announcements of planned attacks on specific companies or countries
Hacktivist statements -
explanations on the motivation behind their ideology and their targets
Alliance formation -
announcements of planned attacks on specific companies or countries
Promotion -
invitations to join new Telegram channels (often after bans) or advertisements for services such as hosting or proxies
Other:
- News - about global events or public mentions about a group
- Recruitment - calls to join hacktivist teams
- Attack summaries - periodic operational reports
- Guides and tutorials - guides and tutorials on how to organize DDoS, penetration testing, and related tactics
Distribution of hacktivist message categories in 2025
Reports on completed attacks are the most common hashtagged content, accounting for 59% of all hacktivist messages with hashtags