Hacking groups range from friends who met on message boards to teams that governments say work for intelligence agencies. Here are sixteen of the best known and what each is known for.
For state-linked groups, the attribution comes from governments and security researchers. The countries named have generally denied involvement, and the names are labels used by researchers, not the groups' own.
The groups are grouped roughly by era, starting with the hacker clubs of the 1980s.
The groups
- Anonymous — A loose, leaderless collective that grew out of image boards. Known for Project Chanology (2008), Operation Payback (2010) and the Guy Fawkes mask.
- LulzSec — A small group that attacked Sony, PBS and other targets for 50 days in 2011 before announcing it was disbanding. Members were later arrested.
- Cult of the Dead Cow — A long-running hacker collective that released the Back Orifice 2000 remote-access tool in 1999 and helped popularise the word “hacktivism.”
- Legion of Doom — A US hacker group of the 1980s whose members wrote early technical files about phone networks. It had a famous rivalry with the Masters of Deception.
- Masters of Deception — A New York hacker group whose members were indicted in 1992 in one of the first major federal hacking cases.
- Chaos Computer Club — Germany's long-standing hacker association, known for the 1984 videotex bank stunt and for advising on technology and privacy policy.
- L0pht Heavy Industries — A Boston group that told the US Senate in 1998 that they could take down the internet within about 30 minutes. Several members later joined the security industry.
- Lazarus Group — A name researchers use for hackers linked by the US and others to North Korea, blamed for the Sony Pictures attack, WannaCry and several large crypto thefts.
- Fancy Bear (APT28) — A group that Western governments link to Russia's military intelligence (GRU), blamed for hacks of political organizations and others.
- Cozy Bear (APT29) — A group that Western governments link to Russia's foreign intelligence service, blamed for the SolarWinds supply-chain attack.
- Sandworm — A group linked to Russia's military intelligence by Western governments and associated with attacks on Ukraine's power grid and NotPetya.
- Equation Group — A highly sophisticated group identified by researchers in 2015. Researchers and the leaked Shadow Brokers files linked it to the NSA, which has not officially confirmed this.
- Syrian Electronic Army — A pro-government group that defaced websites and briefly took over media social-media accounts in the early 2010s.
- REvil (Sodinokibi) — A ransomware-for-hire gang behind the 2021 Kaseya attack. Authorities in Russia announced arrests of alleged members in 2022.
- Conti — A ransomware gang that attacked hospitals and governments. Internal chats were leaked in 2022 after it took sides in the war in Ukraine.
- Scattered Spider — A loosely organised, mostly English-speaking group known for tricking help desks by phone and for attacks on large casino and retail companies in 2023.
Frequently asked questions
What is the most famous hacking group?
Anonymous is probably the best known, though it is a loose collective rather than a single group.
What is the Lazarus Group?
A name researchers use for hackers that the US and others link to North Korea.
What is a ransomware gang?
A criminal group that locks a victim's data and demands payment, often selling its tools to others.
Who names these groups?
Mostly security researchers. Names such as Fancy Bear and Cozy Bear are labels created by researchers.