GTG-50029
GTG-50029 is a threat actor group with an ideological motive, tracked by Brandefense. It targets 4 sectors, including Government and Technology. It uses 5 MITRE ATT&CK techniques and exploits 1 known CVE.
- Techniques
- 5
- Exploited CVEs
- 1
- Record updated
Who They Target.
About GTG-50029.
Single hacktivist operator that targeted European political organisations, media outlets, think tanks and the SaaS providers they rely on; at least 14 of 42 tracked targets were internally compromised. Initial access relied on a previously undocumented WordPress re-installation race condition that created a rogue administrator account without valid credentials. The operator deployed a credential-harvesting must-use plugin, hid a webshell among site font assets, poisoned victim backups and fingerprinted a media outlet's readers at browser level. Case code from Anthropic's September 2026 misuse report.
Last updated Sep 15, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.