Hackers and hacker groups: an overview

Start with what is a hacker if you want the definitions first. Below, every group or person is described from public records such as indictments, court outcomes and government statements. Where something was claimed but not proven, we say so.

Research and civil-society hacker groups

Chaos Computer Club (CCC). Founded in 1981 in Germany, the CCC is a non-profit association that says it has about 8,000 members. It is known for public demonstrations of security flaws and for its annual Chaos Communication Congress. See our Chaos Computer Club profile.

State-linked groups

GRU-linked groups. In October 2018 the UK government published a list of names that it said were associated with Russia's GRU, including APT28, Fancy Bear, Sandworm, Voodoo Bear and Cyber Berkut, and said it assessed with high confidence that the GRU was almost certainly behind a series of attacks. In July 2018 a US grand jury indicted 12 GRU officers over hacking connected to the 2016 presidential election. In 2020 six more officers were charged over NotPetya and other destructive attacks. None has stood trial in the US.

Lazarus Group. In 2018 the US Justice Department charged North Korean programmer Park Jin Hyok, saying he was part of a team behind the 2014 Sony Pictures attack and the 2017 WannaCry ransomware. In February 2025 the FBI said North Korea was responsible for the theft of about $1.5 billion in virtual assets from the exchange Bybit. See cyber attacks.

Criminal groups

LockBit. For several years LockBit was one of the most active ransomware operations. In February 2024 an international operation led by the UK's National Crime Agency took control of its systems and leak site.

Lapsus$. A loosely organized group, mostly of teenagers and young adults, that broke into large technology companies in 2021 and 2022 by tricking staff and abusing phone-number-based logins. The US Cyber Safety Review Board, a body set up under CISA, published a review of its methods in 2023.

Scattered Spider. CISA and the FBI issued an advisory in 2023 describing this group's use of social engineering, such as posing as IT staff and persuading help desks to reset passwords or multi-factor settings, against large companies.

DarkSide and Cl0p. DarkSide's ransomware was behind the 2021 Colonial Pipeline shutdown, according to the FBI. Cl0p exploited the MOVEit file-transfer flaw in 2023. Both are covered in cyber attacks.

Hacktivists

LulzSec. A 2011 group that attacked companies and government sites and published data, largely for publicity. One of its leading members, Hector Monsegur, known as Sabu, cooperated with the FBI and was sentenced in federal court in Manhattan in 2014.

Individuals

George Hotz (geohot). Unlocked the original iPhone in 2007 and was sued by Sony over a PlayStation 3 jailbreak in 2011, settling the case that year. He later founded the driver-assistance company comma.ai. See our George Hotz profile.

Gary McKinnon. A British man accused by the US of breaking into US military and NASA computers in the early 2000s. In October 2012 Home Secretary Theresa May blocked his extradition to the US, saying it would be incompatible with his human rights.

Marcus Hutchins. The British researcher credited with stopping WannaCry's spread in 2017 by registering its kill-switch domain. He later pleaded guilty in the US to charges related to the Kronos banking malware.

What this means for you

Very few people are targets of state units. Many people are targets of criminals using phishing and reused passwords, and several groups above got in by tricking help desks rather than with clever code. The defenses are the same basic steps: unique passwords, multi-factor login (preferably not by text message), updates and backups. See cybersecurity basics and our pages on Facebook, Twitter/X and WhatsApp account security.