Masks Without Disguise: Why Exposed State-Run Hacktivist Personas Survive Attribution

1. Introduction

On 19 March 2026 the United States Department of Justice seized four web domains used by Handala, Justice Homeland and Karma Below, three personas that presented themselves as independent hacktivists and that the Department described as shell entities run by Iran's Ministry of Intelligence and Security (MOIS) [1]. Handala had claimed a destructive wiper attack on the American medical technology company Stryker a week earlier [2]. By any standard the disguise had failed: the United States government had named the sponsor, seized the infrastructure and described the operation as psychological warfare. Yet Handala did not disappear. Within weeks it was running an intimidation campaign against American service members in Bahrain [3], and by July threat-intelligence analysts reported that both Handala and Homeland Justice had rebuilt their infrastructure and kept communicating [4]. Homeland Justice itself had been publicly attributed to Iran by American agencies in 2022 [5], and was still claiming attacks on Albanian institutions four years later [6]. CyberAv3ngers, attributed to the cyber command of Iran's Islamic Revolutionary Guard Corps (IRGC) in 2023 and the subject of American sanctions in 2024 [7,8], was the focus of a new multi-agency advisory in April 2026 [9].

These cases pose a puzzle for the study of covert action and cyber conflict. A persona is a disguise. Its conventional purpose is to let a state act while denying that it has acted, and public attribution by a government is designed to remove exactly that option. Canfil's argument that plausible deniability in cyberspace has lost much of its value [10] adds to the puzzle. If victims now blame sponsors on circumstantial evidence, states should bring their operations in-house, and the Iranian units behind these personas are in-house: they belong to a ministry and a military command. Why, then, do states keep wearing a disguise that no longer disguises anything?

This article argues that a persona does two jobs, and attribution destroys only one of them. The first is concealment: the persona hides the sponsor's hand. The second is presentation: the persona gives the sponsor a public voice that is not its own, through which it can claim operations, threaten targets, leak material and appear as a movement rather than a government, without officially avowing any of it. Credible attribution eliminates concealment value. It leaves presentation value largely intact, and it can increase it, because an exposed persona that keeps operating advertises the sponsor's reach while still sparing it the costs of avowal. Personas therefore survive exposure when their value lies mainly in presentation, and they lapse when the operation or event they were built for ends.

The argument is developed as typological theory and examined against the universe of hacktivist-branded personas that governments have publicly attributed to a state sponsor since 2014. Of the eight personas that were active when they were attributed and whose later course can be established, none was retired by attribution itself. The three that lapsed were built for a single operation or event and went quiet when it ended. The four that persisted were open-ended campaign brands. One event-bound persona lapsed after its event and was revived when a new war restored demand for it, and a persona that had been dormant when it was attributed was revived in the same way. One persisting persona also broke away from its sponsor, suggesting that exposure can change the relationship between a state and its brand rather than ending the brand.

The article makes three contributions. It extends Canfil's account of the decline of deniability by explaining why insourced operations keep their non-state costumes. It adds a distinction between concealment and presentation to the literature on implausible deniability [11,12], specifying what an open secret is still good for. And it offers a measure of success for public attribution that does not depend on a persona disappearing. Section 2 reviews the relevant literatures. Section 3 develops the argument and its propositions. Section 4 sets out the design, Section 5 examines the cases, Section 6 considers rival explanations, and Section 7 draws out implications.

2. Deniability, Attribution and the Persona Problem

The study of covert action has long treated deniability as the reason states act in secret. Carson shows that secrecy also serves to manage escalation: states conceal intervention, and adversaries often collude in keeping it concealed, when public exposure would force a response neither side wants [12,13]. Cormac and Aldrich argue that much contemporary covert action is only thinly hidden, and that "implausible deniability" can still be useful because it gives states room to avoid formal acknowledgement even when their involvement is widely assumed [11]. Sukin and Hedgecock find, in survey experiments with American military cadets, that deniable operations, including cyber operations and the use of proxies, make a forceful response more likely but less intense [14]. Pischedda, Cheon and Moller show that targets and third parties reach different conclusions about responsibility for unclaimed attacks, because the anger felt by targets pushes them towards attribution [15]. Deniability, in this literature, is neither binary nor audience-free.

Research on cyber proxies asks why states work through non-state actors and how they manage them. Maurer distinguishes delegation, orchestration and sanctioning as relationships between states and hackers [16]. Borghard and Lonergan examine the risks of loss of control [17], and Akoto finds that domestic accountability institutions constrain the use of proxies [18]. Canfil brings the two literatures together. He argues that as target states become willing to hold sponsors responsible on circumstantial evidence, the incentive to outsource declines, and he finds that American public responses to cyber operations are followed by adversaries using more of their own personnel [10]. His argument concerns the choice between outsourcing and insourcing. It does not address what happens to the public identities under which insourced operations are conducted, and that is the question here.

A third literature treats public attribution as a political act. Egloff describes it as meaning-making: a decision about how audiences should interpret an intrusion, taken for strategic reasons rather than simply because the evidence is in [19]. Egloff and Smeets set out the considerations that govern such decisions [20], and Finnemore and Hollis show how accusations shape the normative environment of cyberspace [21]. Studies of publicity and secrecy find that defenders disclose operations far more often than perpetrators claim them [22], and that perpetrators sometimes claim credit for strategic reasons [23]. This literature explains why governments attribute. It says less about what attribution does to the thing it exposes.

The persistence of exposed personas has been noticed by practitioners. Mandiant describes how state actors cultivate hacktivist personas as recognisable brands that let them spread messages behind a veil of plausible deniability [24], and SentinelOne characterises Iranian personas as "reusable operational infrastructure" that operators rebuild after takedowns [4]. These reports establish the phenomenon. They do not explain which personas survive exposure and which do not, and they do not connect the pattern to the theory of covert action.

3. Concealment and Presentation

A persona, as the term is used here, is a named public identity presented as non-state, through which operations are claimed, threats are issued or stolen material is released. The persona is distinct from the unit that operates it and from the malware or infrastructure it uses. It is, in the first instance, a communicative device.

Two Sources of Value

The first source of value is concealment. The persona obscures who is acting, so that the sponsor can conduct operations without paying the diplomatic, legal or escalatory costs of being identified. This is the value on which the deniability literature concentrates, and it is the value that credible public attribution is meant to remove. Once a government with standing has named the sponsor, published its evidence and taken measures against the sponsor's infrastructure, concealment value falls towards zero for most audiences that matter to the sponsor.

The second source of value is presentation, and it has several components. A persona gives the sponsor a voice that it does not have to avow. The sponsor can claim operations, threaten targets and release material through it while its officials continue to decline responsibility, which preserves diplomatic room and avoids formal acknowledgement even when involvement is not in doubt. This is the core of implausible deniability [11]. The operators of the revived Pay2Key persona put the point directly, telling researchers that the platform let them carry out attacks "without breaking the ceasefire" [25]. A persona also accumulates an audience: channels, followers, a recognisable name and a record of claims that make its next claim newsworthy. Like militant organisations that claim credit selectively to build a reputation [26], a persona's claims carry weight because of what it has claimed before. Finally, a persona can present the sponsor's actions as those of a wider movement, which serves the psychological and influence purposes that American officials attributed to Handala [1].

Attribution affects these components unevenly. It does not force the sponsor to avow the persona; an exposed persona can still speak without official acknowledgement. It does not destroy the audience; publicity may enlarge it. And it may add a new form of value, since a persona that continues to operate after being named signals that the sponsor is undeterred.

When Personas Lapse

Presentation value depends on demand. A persona built for one operation or one event, such as a single intrusion or an election, has little further use once that operation or event is over, whether or not it has been exposed. A persona built as an open-ended campaign brand, speaking for the sponsor in a continuing conflict, retains its use as long as the conflict continues. Demand can also return. A persona that has lapsed can be revived if a new crisis makes its name, audience and non-avowed voice valuable again, and the cost of revival is low because the persona's assets are mainly reputational and its infrastructure is cheap to replace.

Presentation value also belongs partly to the people who run the persona. If the operators are not the sponsor's own staff, exposure and the costs that follow may lead the sponsor to withdraw support while the operators keep the brand.

Propositions

Four propositions follow.

P1 (exposure): Credible public attribution does not by itself retire an active persona.

P2 (function): Personas built as open-ended campaign brands persist after attribution; personas built for a single operation or event lapse when that operation or event ends, whether or not they have been attributed.

P3 (revival): Lapsed personas, including those already attributed, are revived when a new conflict restores demand for their presentation value.

P4 (decoupling): Where a persona's operators are not the sponsor's own staff, exposure can loosen the sponsor's control, so that the brand outlives the sponsorship.

The argument is falsified if attributed personas that were open-ended campaign brands regularly go quiet soon after attribution while their conflicts continue, if event-bound personas regularly outlive their events, or if persistence is better explained by the identity of the sponsor or by the period than by the persona's function.

4. Research Design and Methods

The design is a structured comparison of the universe of eligible cases, used to develop and probe a typological argument [27,28]. The universe comprises hacktivist-branded personas that a government has publicly attributed to a state sponsor since 2014, identified from official statements, advisories, indictments and sanctions announcements. To test the effect of attribution, a persona must have been active when it was attributed, defined as having claimed or conducted an operation in the three months before the attribution, and its subsequent course must be observable.

Function is coded from the persona's behaviour before attribution, so as not to code it from its outcome. A persona is coded as event-bound if all of its claimed operations before attribution were tied to a single operation or a single dated event, such as an election or a sporting event. It is coded as an open-ended campaign brand if it made claims across more than one operation over a period of six months or more, in service of a conflict with no terminal date. The outcome is coded as persistence if activity under the same name was reported more than one month after attribution, as lapse if no such activity was found after the operation or event ended, and as revival if a lapsed persona resumed activity.

Evidence comes from official documents, threat-intelligence reports whose authors are identified, and press reporting. Retirement is inferred from the absence of reported activity, which is a weaker inference than persistence and is flagged where it applies. The full coding, with sources for every entry, is reported in Appendix A and deposited as a supplementary spreadsheet. The research used only publicly available documents. Generative AI (Claude, Anthropic) was used to assist with searching for and checking sources, compiling and coding the case evidence, and drafting and editing the text; the author verified every source and coding decision and is responsible for the content.

5. The Cases

The search identified thirteen attributed personas. Five are excluded from the test: CyberCaliphate, which the United Kingdom attributed to Russian military intelligence in 2018 [29] after a period of activity that ended in 2015; Pay2Key, attributed by American agencies in 2024 for a campaign conducted in 2020 [30]; and Cyber Berkut, Fancy Bears' Hack Team and Karma Below, whose activity around the time of attribution could not be established. The pattern of exclusions is itself informative. Several Russian personas were attributed years after they had gone quiet, which means that attribution in those cases could not have retired them. The remaining eight cases are summarised in Table 1.

Note: Excluded because dormant or unverifiable at attribution: CyberCaliphate, Pay2Key, Cyber Berkut, Fancy Bears' Hack Team, Karma Below. GRU = Russian military intelligence; IRGC = Islamic Revolutionary Guard Corps; MOIS = Iran's Ministry of Intelligence and Security. Full coding in the supplementary material.

Lapse After the Event

Guardians of Peace, the persona that claimed the 2014 intrusion into Sony Pictures, was attributed to North Korea by the Federal Bureau of Investigation on 19 December 2014 [31]. It posted a mocking reply the next day [32], and no later activity has been reported. The persona had been built for one operation, and it ended with that operation.

Guccifer 2.0 is the clearest evidence against the view that attribution retires personas. American officials publicly linked its releases to Russian government-directed efforts on 7 October 2016 [33], yet the persona continued to post for three months and last surfaced on 12 January 2017 [34]. It went quiet after the election for which it had been built, not after it was named. The Department of Justice identified it as a persona of Russian military intelligence in 2018, by which time it had long been dormant.

The eight personas that an October 2024 advisory attributed to the Iranian company Emennet Pasargad were described as "cover-hacktivist groups" run by the company to protest the Gaza war and to target events such as the 2024 Olympic Games [35]. No activity under those names was found after the advisory. This case is the weakest in the set: the inference rests on absence of evidence, and the coding of these personas as event-bound depends on the advisory's description of them as covers for specific operations.

Persistence

The four open-ended campaign brands all persisted. Homeland Justice, attributed to Iran by American agencies in September 2022 for attacks on the Albanian government [5], continued to operate against Albania, claiming an attack on the Albanian parliament reported in March 2026 [6], and rebuilt its infrastructure after the 2026 seizures [4]. CyberAv3ngers, attributed to the IRGC's cyber command in December 2023, whose officials were sanctioned in February 2024 [7,8], was behind a new campaign against programmable logic controllers in American infrastructure that federal agencies linked in April 2026 to hostilities between Iran, the United States and Israel [9]. Handala continued to operate after the March 2026 seizures, running an intimidation campaign against American service members in Bahrain in April [3] and maintaining its communications into July [4]; Recorded Future reported that the ministry had likely extended the Handala brand to physical threat personas [40].

The Cyber Army of Russia Reborn, sanctioned by the United States Treasury in July 2024, also persisted, but in a different way. A later multinational advisory reports that Russian military intelligence funded the persona's tools through at least September 2024, after which administrators dissatisfied with the level of support formed a new group, Z-Pentest, that used the same tactics, techniques and procedures without the involvement of Russian military intelligence [39]. The brand and its methods survived; the sponsorship did not. This is the outcome that P4 anticipates, and it suggests that where operators have their own stake in a persona, exposure can change the relationship between a state and its brand rather than ending the brand.

Revival

The persona known as "Robert" released material stolen from the 2024 Trump campaign. American agencies attributed the operation to Iran in August 2024, and the Department of Justice indicted three IRGC employees in September [36,37], although neither document names the persona itself. Robert went quiet after the election. In late June 2025, during the war between Israel and Iran, it resurfaced in conversations with Reuters, claiming to hold about 100 gigabytes of emails from Trump administration officials [38]. The persona lapsed after the event it was built for and was revived when a new conflict made it useful again.

Pay2Key, excluded from the test because it was dormant when attributed, shows the same pattern. The persona had posed as a ransomware operation in a 2020 campaign against Israeli targets that American agencies later assessed as having served Iranian state interests [30]. In February 2025, several months after that assessment, it reappeared as Pay2Key.I2P, offering affiliates a larger share of proceeds for attacks on "the enemies of Iran" [25].

Assessment

The evidence is consistent with P1: none of the eight personas active at attribution ceased because it was attributed, and in the clearest case, Guccifer 2.0, the persona kept posting after it had been named. It is consistent with P2: the three personas that lapsed were event-bound, and the four that persisted were open-ended campaign brands. Robert fits both P2 and P3, lapsing when its event ended and returning when demand revived, and Pay2Key supports P3 from outside the test set. The Cyber Army of Russia Reborn supports P4.

6. Rival Explanations

Three alternatives deserve consideration. The first is that persistence reflects the sponsor rather than the persona's function: Iran may simply keep its personas and other states may not. The cases do not support this. Iranian personas appear among those that lapsed (the Emennet personas) and those that persisted, and so do Russian ones (Guccifer 2.0 and the Cyber Army of Russia Reborn). The sponsor does not predict the outcome; function does.

The second is that persistence reflects the period. All four personas that persisted were attributed in 2022 or later, during wars in Ukraine and the Middle East, and war raises demand for every instrument of pressure. This alternative cannot be ruled out, and it overlaps with the argument, since the theory expects continuing conflict to sustain demand for presentation. But it is not sufficient. The Emennet personas were attributed during the Gaza war and lapsed, and Robert lapsed in 2024 despite the ongoing conflict and returned only when the war with Israel created a new use for it. What matters appears to be whether the persona has a role in the conflict, not only whether a conflict is under way.

The third is inertia: exposed personas continue because operators do not bother to retire them, not because they are valuable. Inertia cannot explain revival. Robert and Pay2Key were reactivated after periods of inactivity, which requires a decision, and Handala's operators replaced seized infrastructure and extended the brand to new purposes, which requires investment.

A fourth possibility is that attribution does not reach the audiences that matter, so that concealment value survives among them. Pischedda, Cheon and Moller's finding that third parties judge responsibility differently from targets [15] makes this plausible for some audiences, and it would complement rather than contradict the argument. It does not explain why personas built for single events lapse whether or not they are exposed.

7. Implications

For the study of deniability, the argument specifies what an open secret is good for. Implausible deniability is usually discussed as a residue of concealment: the room that remains when a secret is widely suspected but not formally acknowledged. The personas examined here suggest that it is better understood as a separate asset. A sponsor that no longer hides its hand can still speak through a voice it does not own, and that voice has an audience, a history and a use that attribution does not remove.

For Canfil's argument, the cases suggest an amendment rather than a rejection. States that have brought their cyber operations in-house have not abandoned the costume. The move from outsourcing to insourcing changes who conducts operations. It does not change how they are presented, because presentation value was never the same thing as deniability.

For attribution policy, the implication is that retirement is the wrong measure of success. Attribution reliably destroys concealment value, and that is a real achievement: it returns responsibility to the sponsor and allows responses to be directed at the state. But if the aim is to stop a persona operating, measures must target its presentation assets, its channels, audience and infrastructure, and must be repeated, since the cost of rebuilding is low. The seizure of Handala's domains, followed by the rebuilding of its infrastructure, illustrates both the logic and its limits.

8. Limitations and Conclusion

The evidence is thin. The test set contains eight cases, one of which (the Emennet personas) rests on the absence of reported activity, and the coding of Robert depends on press reporting because official documents do not name the persona. Most attributions in the set were made by the United States and its allies, and all the personas were run by their adversaries, so the argument has not been examined against personas run by Western states. Function and period overlap, and the design cannot fully separate them.

Within these limits, the cases support a simple conclusion. Public attribution strips a persona of its ability to conceal, but not of its ability to speak for a sponsor that will not speak for itself. Personas built to hide one operation die with that operation. Personas built to carry a sponsor's voice through a conflict survive their exposure, and can be revived long after it. As more personas are attributed during the current wars, the argument can be tested on a larger set of cases, and the distinction between concealment and presentation can be examined for covert action beyond cyberspace.