A hacktivist group is a public-facing collective or persona that claims cyber activity for political, ideological, or influence purposes. The label may describe a real loose network of actors, a branded online identity, or a deliberate cover used to make an operation look activist-driven.
In cyber security, the term matters because the claim itself is not proof of who operated the attack. Hacktivist branding can support propaganda, deflection, or false-flag behavior, while the technical evidence may point elsewhere. Defenders therefore treat public claims as one input among many and look for infrastructure overlap, credential abuse, malware patterns, and command-and-control infrastructure. In practice, attribution depends on combining messaging, telemetry, and network traces rather than trusting the headline alone.