Signal in the noise: what hashtags reveal about hacktivism in 2025

A Securelist report, published on 14 October 2025, analyses more than 11,000 posts from over 120 hacktivist groups operating across the surface and dark web, with a particular focus on groups targeting the MENA region. It finds that hacktivists are motivated by politics and prioritise visibility over technical sophistication, using posts to amplify messages, coordinate activity, or claim credit.

Telegram emerges as the command centre for planning and action, with X (ex-Twitter) in second place for hacktivist activity. The study identifies 2063 unique hashtags in 2025, 1484 of which are new, with many tied to specific groups or campaigns; most hashtags are short-lived, lasting about two months, though popular ones endure longer when alliances amplify them. In terms of impact, 58% of reported posts relate to completed attacks, and among those, DDoS accounts for 61% of the techniques.

The researchers note that spikes in rhetoric do not reliably predict more attacks, but timing matters, as threats typically refer to near-term actions, making open-channel monitoring useful for early warning.