{
	"id": "33a25c0e-7df7-4ae8-ab9f-c34b00e50d29",
	"created_at": "2026-04-06T00:07:57.972256Z",
	"updated_at": "2026-04-10T03:38:09.962034Z",
	"deleted_at": null,
	"sha1_hash": "92c48c045c0c9b0ab41e76e9bcde6d9c1b968eb4",
	"title": "OurMine",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 153299,
	"plain_text": "OurMine\r\nBy Contributors to Wikimedia projects\r\nPublished: 2015-07-07 · Archived: 2026-04-05 16:15:30 UTC\r\nFrom Wikipedia, the free encyclopedia\r\nOurMine\r\nOurMine logo\r\nFormation September 14, 2014; 11 years ago[1]\r\nType Hacker group\r\nWebsite ourmine.org\r\n[dead link]\r\nOurMine is a hacker group[2] that is known for hacking popular accounts and websites, such as Jack Dorsey and\r\nMark Zuckerberg's Twitter accounts. The group often causes cybervandalism to advertise their commercial\r\nservices,[3][4][5] which is among the reasons why they are not widely considered to be a \"white hat\" group.[3][4]\r\nAs of 2016, their commercial services included security scans and audits.[3] Payments were collected through\r\nPayPal.[3] The group states they do not change passwords of hacked accounts.[3]\r\nIn 2016, OurMine hacked the Twitter accounts of Wikipedia co-founder Jimmy Wales,\r\n[6]\r\n Pokémon GO creator\r\nJohn Hanke,\r\n[7][8]\r\n Twitter co-founder Jack Dorsey,\r\n[9]\r\n Google CEO Sundar Pichai,\r\n[10]\r\n and Facebook co-founder\r\nMark Zuckerberg, whose Pinterest was also hacked.[11] In addition to social media accounts, the group has hacked\r\nthe website TechCrunch.\r\n[12][13][14]\r\nhttps://en.wikipedia.org/wiki/OurMine\r\nPage 1 of 4\n\nIn October, BuzzFeed News published an article linking the OurMine group to a Saudi Arabian teenager using the\r\nname Ahmad Makki on social media. OurMine denied the allegations, claiming that Makki was only a \"fan\" of the\r\ngroup.[15] One day after the article's publication, OurMine infiltrated BuzzFeed's website and altered the content\r\nof several posts to read \"Hacked By OurMine\".[16][17]\r\nOther 2016 hacks include the Twitter accounts of Sony President Shuhei Yoshida;\r\n[18]\r\n the Wikimedia global\r\naccount of Jimmy Wales;\r\n[19]\r\n the Twitter accounts of Netflix and Marvel;\r\n[20]\r\n the Twitter accounts of Sony Music\r\nGlobal;[21] the Instagram accounts of National Geographic;\r\n[22]\r\n and the Twitter accounts of National Geographic\r\nPhotography.\r\n[23]\r\nIn 2017, OurMine hacked into a Medium website employee account. The account was part of a strategic\r\npartnerships team, allowing OurMine to hijack blogs belonging to Fortune and Backchannel.\r\n[24]\r\nTwitter accounts hacked in 2017 included that of David Guetta,\r\n[25]\r\n the New York Times,\r\n[26]\r\n the WWE,\r\n[27]\r\n and\r\nGame of Thrones (along with some other HBO TV shows, and HBO's own official account).[28] They also hacked\r\nthe Twitter and Facebook accounts of PlayStation (including a claimed leak of the PlayStation Network\r\ndatabases),[29] FC Barcelona,\r\n[30]\r\n and Real Madrid (including their YouTube channel);[31] several Facebook\r\naccounts of CNN were also hacked.[32]\r\nSome YouTube accounts were hacked by OurMine in 2017 included that of the Omnia Media network, gaining\r\naccess to numerous channels;[33][34][35] and various YouTube channels from the Studio71 network were also\r\nhacked.[36]\r\nOn August 31, OurMine left a message on the homepage of WikiLeaks. \"Hi, it’s OurMine (Security Group), don’t\r\nworry we are just testing your…. blablablab, oh wait, this is not a security test! Wikileaks, remember when you\r\nchallenged us to hack you?\" The messages went on to accuse Anonymous of trying to dox them with false\r\ninformation and included an exhortation to spread the #WikileaksHack tag on Twitter. The message was visible\r\nwhen the site was accessed from certain locations. At the time of publication, some visitors to the site were\r\ngreeted with a message saying that WikiLeaks’ account has been suspended.[37]\r\nIn September 2017, OurMine claimed responsibility for hacking Vevo and publishing more than 3TB of their\r\ninternal documents.[38]\r\nIn January, OurMine compromised the Twitter, Facebook and Instagram accounts of the NFL and 15 NFL teams.\r\n[39]\r\nIn February, OurMine compromised Facebook's Twitter account.[40] Later that month, they also compromised the\r\nTwitter account of South Korean boy band, NCT 127.\r\n[41]\r\nIn May, the group OurMine invaded the Brazilian streaming platform Globoplay and sent a notification to all users\r\nof the Globoplay app.[42]\r\n1. ^ Smith IV, Jack (24 June 2016). \"Meet the new hacker collective targeting the tech elite\". Business Insider.\r\nRetrieved 17 March 2020.\r\nhttps://en.wikipedia.org/wiki/OurMine\r\nPage 2 of 4\n\n2. ^ Hern, Alex (31 August 2017). \"WikiLeaks 'hacked' as OurMine group answers 'hack us' challenge\". The\r\nGuardian. Retrieved 17 March 2020.\r\n3. ^ Jump up to: a\r\n \r\nb\r\n \r\nc\r\n \r\nd\r\n \r\ne\r\n Greenberg, Andy (27 June 2016). \"Meet OurMine, the 'Security' Group Hacking\r\nCEOs and Celebs\". Wired. Retrieved 23 August 2017.\r\n4. ^ Jump up to: a\r\n \r\nb\r\n Horwitz, Josh (6 June 2016). \"What we know about the despised hackers who broke into\r\nMark Zuckerberg's social media accounts\". Quartz (publication). Retrieved 23 August 2017. “OurMine\r\nappear to be neither educators nor activists. They hack the accounts of high profile individuals or entities\r\nseemingly at random, for their own amusement or personal gain.”\r\n5. ^ \"OurMine is now hacking into Minecraft accounts\". PC World. 2016-07-19. Retrieved 23 August 2017.\r\n“In emails, the group has said it merely wants to help the public become aware of today's cybersecurity\r\nproblems, including the use of weak passwords.”\r\n6. ^ \"Wikipedia Co-Founder Jimmy Wales' Twitter Account Hacked By OurMine\". International Business\r\nTimes. 21 August 2016. Retrieved 23 August 2017. “...a member belonging to the hacking group insisted\r\nthat it's just promoting stronger security, claiming that if the group didn't hack famous accounts someone\r\nelse would.”\r\n7. ^ \"John Hanke is hacked' By OurMine\". TechCrunch. 31 July 2016. Retrieved 23 August 2017.\r\n8. ^ Mac, Ryan (31 July 2016). \"Hacker Explains Why OurMine Took Over 'Pokémon GO' Creator's Social\r\nMedia Accounts\". Forbes. Retrieved 23 August 2017.\r\n9. ^ \"Jack Dorsey is hacked' By OurMine\". Mashable. 9 July 2016. Retrieved 23 August 2017.\r\n10. ^ Abhimanyu Ghoshal (27 June 2016). \"Sundar Pichai is hacked' By OurMine\". TheNextWeb. Retrieved 23\r\nAugust 2017.\r\n11. ^ \"Mark Zuckerberg is hacked' By OurMine\". The Wall Street Journal. 7 June 2016. Retrieved 23 August\r\n2017.\r\n12. ^ Gibbs, Samuel (26 July 2016). \"TechCrunch falls victim to OurMine hacking group\". The Guardian.\r\nRetrieved 23 August 2017.\r\n13. ^ \"Le groupe de hackeurs OurMine pirate le site spécialisé TechCrunch\". Le Monde.fr. 27 July 2016.\r\nRetrieved 23 August 2017 – via Le Monde.\r\n14. ^ \"OurMine 'hackers' are targeting news sites now\". Engadget. 26 July 2016. Retrieved 23 August 2017.\r\n15. ^ Bernstein, Joseph (4 October 2016). \"This Saudi Teen Is Probably Behind The Hacks Of Dozens Of Tech\r\nCEOs And Celebrities\". BuzzFeed. Archived from the original on 5 October 2016. Retrieved 5 October\r\n2016.\r\n16. ^ Feldman, Brian (5 October 2016). \"BuzzFeed Hacked by OurMine: 'We Have Your Databases'\".\r\nNYMag.com. Archived from the original on 5 October 2016. Retrieved 5 October 2016.\r\n17. ^ Reisman, Sam (5 October 2016). \"After Outing Alleged Hacker, Buzzfeed Vandalized by 'OurMine'\r\nGroup\". Mediaite. Archived from the original on 5 October 2016. Retrieved 5 October 2016.\r\n18. ^ Mascarenhas, Hyacinth (20 July 2016). \"OurMine hacker group claims to have broken into Minecraft\r\naccounts, targets Sony's Shuhei Yoshida\". IBTimes Co., Ltd. Retrieved 30 December 2016.\r\n19. ^ \"WMF official website\". Retrieved 23 August 2017.\r\n20. ^ Etherington, Darrell (21 December 2016). \"OurMine hacks Netflix, Marvel Twitter accounts\". Oath.\r\nRetrieved 30 December 2016.\r\n21. ^ DAILEDA, COLIN (26 December 2016). \"OurMine just used hacking to debunk a fake Britney Spears\r\ntweet\". Mashable. Retrieved 26 December 2016.\r\nhttps://en.wikipedia.org/wiki/OurMine\r\nPage 3 of 4\n\n22. ^ WINT, BRADLEY (30 December 2016). \"National Geographic Instagram account hacked\". TMDigital.\r\nRetrieved 30 December 2016.\r\n23. ^ Amir, Waqas (31 December 2016). \"OurMine Group Hacks Nat Geo Photography's Twitter Account\".\r\nAtaaz. Retrieved 31 December 2016.\r\n24. ^ \"A Hacker Group Hijacked Some Medium Blogs (Including Ours)\". Fortune. Retrieved 23 August 2017.\r\n25. ^ Stevo, jr (7 January 2017). \"DAVID GUETTA HAS BEEN HACKED BY OURMINE TEAM\". EDM\r\nSauce. Retrieved 23 August 2017.\r\n26. ^ SILVERSTEIN, JASON (22 January 2017). \"New York Times Video account apparently hacked, posts\r\nfake news tweet about Russia attacking U.S.\" NYDailyNews.com. Retrieved 23 August 2017.\r\n27. ^ Singh, Manish (29 January 2017). \"OurMine just hacked a bunch of WWE accounts\". Mashable.\r\nRetrieved 23 August 2017.\r\n28. ^ Samuel Gibbs (17 August 2017), \"Game of Thrones secrets revealed as HBO Twitter accounts hacked\",\r\nThe Guardian, retrieved 23 August 2017\r\n29. ^ Valentine, Rebekah (20 August 2017). \"Did PlayStation just get hacked?\". Fansided. Archived from the\r\noriginal on 13 April 2020. Retrieved 23 August 2017.\r\n30. ^ \"Barcelona Twitter account hacked as club 'announce' signing of Angel Di Maria | Goal.com\". Retrieved\r\n2017-08-26.\r\n31. ^ \"'Welcome Messi!' – hacked Real Madrid Twitter account announces signing\". The Guardian. Press\r\nAssociation. 2017-08-26. ISSN 0261-3077. Retrieved 2017-08-26.\r\n32. ^ STRANGE, ADARIO (30 January 2017). \"Several CNN Facebook accounts hacked by OurMine\".\r\nMashable. Retrieved 23 August 2017.\r\n33. ^ \"YOUTUBERS HACKED BY OURMINE...\" NewGeekers. 2 April 2017. Archived from the original on 24\r\nApril 2017. Retrieved 23 August 2017.\r\n34. ^ \"YouTubers hacked by OurMine\". Esports News. 2 April 2017. Retrieved 23 August 2017.\r\n35. ^ \"\"OurMine Are Back!\" YouTube Hack Explained – Channels Under Attack\". PowerPYX. 2 April 2017.\r\nRetrieved 23 August 2017.\r\n36. ^ McLeish, Richard (14 April 2017). \"YouTube accounts hacked by online security group\". The Sydney\r\nMorning Herald. Retrieved 23 August 2017.\r\n37. ^ Hern, Alex (31 August 2017). \"WikiLeaks 'hacked' as OurMine group answers 'hack us' challenge\". The\r\nGuardian. Retrieved 13 February 2019.\r\n38. ^ CNET Internal Vevo documents leaked online after hack. 15 September 2017. Accessed 15 September\r\n2017.\r\n39. ^ \"Twitter and Facebook accounts for 15 NFL teams hacked\". BBC. 28 January 2020.\r\n40. ^ Messenger. \"Hi, we are O u r M i n e.\" Twitter. Retrieved 7 February 2020.\r\n41. ^ \"NCT 127's official Twitter account gets hacked by white hat hackers\".\r\n42. ^ \"Globoplay hackeado? Globo esclarece notificação enviada aos usuários do app\". 17 May 2020.\r\nSource: https://en.wikipedia.org/wiki/OurMine\r\nhttps://en.wikipedia.org/wiki/OurMine\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia",
		"ETDA"
	],
	"references": [
		"https://en.wikipedia.org/wiki/OurMine"
	],
	"report_names": [
		"OurMine"
	],
	"threat_actors": [
		{
			"id": "e4ccfe5c-4d77-4503-bf1c-36076dbd78d0",
			"created_at": "2022-10-25T16:07:24.522697Z",
			"updated_at": "2026-04-10T02:00:05.02215Z",
			"deleted_at": null,
			"main_name": "OurMine",
			"aliases": [
				"ATK 128",
				"TAG-HA10"
			],
			"source_name": "ETDA:OurMine",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "cf7fc640-acfe-41c4-9f3d-5515d53a3ffb",
			"created_at": "2023-01-06T13:46:38.228042Z",
			"updated_at": "2026-04-10T02:00:02.883048Z",
			"deleted_at": null,
			"main_name": "APT1",
			"aliases": [
				"PLA Unit 61398",
				"Comment Crew",
				"Byzantine Candor",
				"Comment Group",
				"GIF89a",
				"Group 3",
				"TG-8223",
				"Brown Fox",
				"ShadyRAT",
				"G0006",
				"COMMENT PANDA"
			],
			"source_name": "MISPGALAXY:APT1",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "74f1da67-5bc9-49ee-ba8e-b7e8b452a2c2",
			"created_at": "2023-01-06T13:46:39.021238Z",
			"updated_at": "2026-04-10T02:00:03.183989Z",
			"deleted_at": null,
			"main_name": "OurMine",
			"aliases": [],
			"source_name": "MISPGALAXY:OurMine",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "3aaf0755-5c9b-4612-9f0e-e266ef1bdb4b",
			"created_at": "2022-10-25T16:07:23.480196Z",
			"updated_at": "2026-04-10T02:00:04.626125Z",
			"deleted_at": null,
			"main_name": "Comment Crew",
			"aliases": [
				"APT 1",
				"BrownFox",
				"Byzantine Candor",
				"Byzantine Hades",
				"Comment Crew",
				"Comment Panda",
				"G0006",
				"GIF89a",
				"Group 3",
				"Operation Oceansalt",
				"Operation Seasalt",
				"Operation Siesta",
				"Shanghai Group",
				"TG-8223"
			],
			"source_name": "ETDA:Comment Crew",
			"tools": [
				"Auriga",
				"Cachedump",
				"Chymine",
				"CookieBag",
				"Darkmoon",
				"GDOCUPLOAD",
				"GLOOXMAIL",
				"GREENCAT",
				"Gen:Trojan.Heur.PT",
				"GetMail",
				"Hackfase",
				"Hacksfase",
				"Helauto",
				"Kurton",
				"LETSGO",
				"LIGHTBOLT",
				"LIGHTDART",
				"LOLBAS",
				"LOLBins",
				"LONGRUN",
				"Living off the Land",
				"Lslsass",
				"MAPIget",
				"ManItsMe",
				"Mimikatz",
				"MiniASP",
				"Oceansalt",
				"Pass-The-Hash Toolkit",
				"Poison Ivy",
				"ProcDump",
				"Riodrv",
				"SPIVY",
				"Seasalt",
				"ShadyRAT",
				"StarsyPound",
				"TROJAN.COOKIES",
				"TROJAN.FOXY",
				"TabMsgSQL",
				"Tarsip",
				"Trojan.GTALK",
				"WebC2",
				"WebC2-AdSpace",
				"WebC2-Ausov",
				"WebC2-Bolid",
				"WebC2-Cson",
				"WebC2-DIV",
				"WebC2-GreenCat",
				"WebC2-Head",
				"WebC2-Kt3",
				"WebC2-Qbp",
				"WebC2-Rave",
				"WebC2-Table",
				"WebC2-UGX",
				"WebC2-Yahoo",
				"Wordpress Bruteforcer",
				"bangat",
				"gsecdump",
				"pivy",
				"poisonivy",
				"pwdump",
				"zxdosml"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434077,
	"ts_updated_at": 1775792289,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/92c48c045c0c9b0ab41e76e9bcde6d9c1b968eb4.pdf",
		"text": "https://archive.orkl.eu/92c48c045c0c9b0ab41e76e9bcde6d9c1b968eb4.txt",
		"img": "https://archive.orkl.eu/92c48c045c0c9b0ab41e76e9bcde6d9c1b968eb4.jpg"
	}
}