Overview 

The Night Hunters is a pro-Indian hacktivist collective that emerged in early 2024. The group is known for website defacements, distribution of leaked credentials, DDoS campaigns, and unauthorized access to web administration panels obtained through compromised credentials. Its activity temporarily slowed after a wave of Telegram channel bans initiated by pro-Bangladeshi hacktivist groups, before the group resumed operations in April 2025. 

In August 2025, The Night Hunters carried out its first confirmed compromises of industrial control systems (ICS), claiming access to internet-exposed Human Machine Interfaces (HMIs) used to monitor a water consumption server (PLC) belonging to the Dhaka Water Supply and Sewerage Authority (DWASA), as well as an electricity load distribution system in Malaysia. This marked a new tactic for the group, extending its propaganda efforts beyond web defacement and into critical infrastructure messaging. 

The group is also notable for taking punitive action against other pro-nationalistic hacktivist collectives that target Indian entities, positioning itself as a defender of Indian cyberspace as much as an offensive actor. Its primary targets remain Bangladesh and Pakistan, with a consistent focus on government and law enforcement institutions. 

Origin, Targets, and Operational Reach 

The group’s targeting pattern reflects its self-positioning as a pro-Indian actor: nations it associates with anti-India sentiment or with hacktivist collectives hostile to Indian interests appear consistently in its target list, alongside opportunistic targeting further afield. Government and law enforcement bodies remain the most consistently reported sector. However, the group’s expansion into energy and utilities — driven by the 2025 ICS compromises — signals a broadening of ambition beyond website-level disruption. 

Operational Capabilities 

• Valid Accounts (Credential Abuse) – The Night Hunters obtain and reuse compromised credentials to gain initial access, escalate privileges, persist within environments, and evade detection. Because this activity can blend in with legitimate account usage, it is often harder to detect than tooling-based intrusions. 

• Exploitation of Public-Facing Applications – The group targets weaknesses in internet-facing hosts, including websites, web servers, databases, and other systems with internet-accessible services, to gain initial footholds. 

• Website Defacement – Consistent with its propaganda-driven motivation, the group modifies visual content on compromised web properties to deliver messaging, claim credit, or intimidate targeted organizations. 

• Network Denial of Service – DDoS campaigns are used to degrade or block availability of targeted resources, often for political messaging, distraction, or in support of other hacktivist activity. 

• Reconnaissance – The group gathers victim identity information (credentials, personal data, authentication configurations) to support targeting and follow-on access. 

• ICS/OT Targeting – A newer capability demonstrated in August 2025: identifying and claiming access to internet-exposed HMIs tied to industrial control systems, used more for propaganda value than sustained operational disruption. 

Tooling: The group is associated with the use of sqlmap, an open-source penetration testing tool that automates detection and exploitation of SQL injection vulnerabilities. In practice, threat actors can use sqlmap to probe exposed web applications, extract data from backend databases, and in some cases gain unauthorized access to hosting systems — all with minimal manual effort. 

Attack Methodology 

An operation typically begins with reconnaissance to identify web-facing infrastructure and personnel associated with a targeted organization or government body, particularly within Bangladesh and Pakistan. Where valid credentials can be obtained — whether through leaks, brute-forcing, or reuse from prior breaches — the group leverages them for initial access, persistence, and privilege escalation (T1078), often without deploying additional malware in order to reduce its detection footprint. 

Where exposed web applications contain exploitable weaknesses, the group may instead pursue direct exploitation (T1190), frequently assisted by automated tools such as sqlmap to accelerate discovery of SQL injection flaws. Once inside a target environment, the group’s objectives split along two lines: propaganda-driven defacement of visual content (T1491), and disruption via network-level DDoS attacks (T1498) intended to degrade availability of targeted websites and services. 

The 2025 shift toward ICS/OT targeting suggests an evolving playbook: rather than confining itself to conventional web infrastructure, the group appears willing to claim access to exposed operational technology interfaces as a higher-impact form of propaganda, even where sustained control or physical disruption is not demonstrated. 

Organizations in Bangladesh, Pakistan, and other frequently targeted countries — particularly those in government, law enforcement, energy, and BFSI — should prioritize credential hygiene and public-facing application security. Recommended measures include: 

• Enforcing multi-factor authentication and monitoring for anomalous use of valid accounts, especially on VPNs, remote desktop, and web administration panels. 

• Regularly patching and configuring internet-facing web applications, with particular attention to SQL injection exposure given the group’s documented use of sqlmap. 

• Implementing DDoS protection, traffic filtering, and redundant infrastructure for critical public-facing services. 

• Restricting and monitoring remote access to HMIs and other OT/ICS interfaces, ensuring they are not needlessly exposed to the public internet. 

• Maintaining an accurate inventory of internet-facing assets and monitoring for reconnaissance activity or credential leaks tied to the organization. 

• Tracking regional geopolitical developments, since the group’s targeting is closely tied to nationalistic and cross-border hacktivist rivalries. 

MITRE ATT&CK Techniques Mapped to The Night Hunters

• Initial Access – Valid Accounts (T1078): The Night Hunters may obtain and abuse credentials of existing accounts to gain initial access, bypassing controls on VPNs, remote desktop, and other externally available services without deploying additional malware. 

• Initial Access – Exploit Public-Facing Application (T1190): The group may exploit software bugs or misconfigurations in internet-facing websites, servers, and other exposed services to gain an initial foothold. 

• Persistence – Valid Accounts (T1078): Compromised credentials, including those from inactive accounts, may be reused to maintain access to a network while evading detection. 

• Privilege Escalation – Valid Accounts (T1078): The group may leverage compromised credentials to gain increased privileges or access to restricted areas of a target’s network. 

• Defense Evasion – Valid Accounts (T1078): Using legitimate account access rather than malware or tooling can make The Night Hunters’ activity harder to distinguish from normal user behavior. 

• Impact – Defacement (T1491): The group modifies visual content on compromised websites to deliver messaging, intimidate targets, or claim credit for an intrusion. 

• Impact – Network Denial of Service (T1498): The Night Hunters conduct network-level DDoS attacks to exhaust bandwidth and disrupt availability of targeted websites and online services. 

• Reconnaissance – Gather Victim Identity Information (T1589): The group may collect identity-related details on targeted organizations and personnel, including usernames, credentials, and authentication configurations, to support targeting. 

Conclusion 

The Night Hunters is a persistent, ideologically driven hacktivist group blending defacement, DDoS, and credential abuse with an emerging push into higher-symbolism targets like exposed ICS interfaces. Tied to India-Bangladesh-Pakistan tensions and prone to feuding with rival collectives, it adds real complexity to attribution. 

Organizations in government, law enforcement, and energy/utilities should prioritize credential security and monitor exposed OT/ICS assets before they become the next target. 

Cyble’s cyber threat intelligence platform tracks actors like The Night Hunters in real time — surfacing exposed infrastructure, leaked credentials, and campaign activity before they escalate. 

Hunters are out there. Cyble sees them first. Track threat actors with Cyble! 

Frequently Asked Questions (FAQs) 

What is The Night Hunters?  

A pro-Indian hacktivist group that emerged in early 2024, known for website defacement, leaked credential distribution, DDoS attacks, and unauthorized access via compromised credentials. 

What does The Night Hunters target?  

Primarily Bangladesh and Pakistan, with additional targeting of Algeria, Indonesia, Iran, Malaysia, and Tunisia. Government and law enforcement institutions are a consistent focus. 

What industries are targeted?  

BFSI, construction, education, energy and utilities, government and law enforcement, IT and ITES, and transportation and logistics. 

Has the group targeted industrial control systems?  

Yes. In August 2025, the group claimed access to internet-exposed HMIs tied to a water consumption server in Bangladesh and an electricity load distribution system in Malaysia — its first documented move into ICS/OT-adjacent targeting. 

What is The Night Hunters’ primary attack method?  

A combination of valid-account abuse, exploitation of public-facing applications (often via sqlmap), website defacement, and network-level DDoS attacks. 

Which MITRE ATT&CK techniques are associated with the group?  

Gather Victim Identity Information (T1589), Valid Accounts (T1078), Exploit Public-Facing Application (T1190), Defacement (T1491), and Network Denial of Service (T1498). 

What should organizations do to defend against The Night Hunters?  

Enforce MFA and monitor account usage, patch and secure public-facing web applications, deploy DDoS protection, restrict internet exposure of OT/ICS interfaces, and track regional hacktivist activity tied to India-Bangladesh-Pakistan tensions. 

Media Disclaimer: This profile is based on the supplied threat-intelligence information and associated MITRE ATT&CK technique descriptions. It is intended for cybersecurity research, threat awareness, detection engineering, and defensive planning. Organizations should independently validate attribution, indicators, targeting information, and campaign details before using them for operational security decisions.