Threat actor
Gloo
Last fetched
Gloo is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.
Description
Gloo, a data analytics company, uses digital surveillance to benefit churches and evangelical campaigns. The company mines personal online data, often belonging to vulnerable populations like immigrants or those facing personal crises, to enable churches to target individuals. Gloo has been linked to campaigns like the $1 billion "He Gets Us" initiative, which uses targeted advertising to promote Christian messages. Although "He Gets Us" initially denied selling data to Gloo, evidence showed that Gloo used data from their campaigns to sell contact information of individuals seeking spiritual support to churches. Through Gloo's Explorer program, the personal data of individuals responding to "He Gets Us" social media ads was sold to local pastors or anyone willing to pay $49/month. This included sensitive information, such as contact details, without proper vetting or guidelines on how the data should be used. In one incident, a pastor publicly shared private messages from a person and exposed her identity to everyone in her church after she responded to an ad on Instagram.
Techniques by tactic
No ATT&CK techniques are recorded for Gloo in WhisperGraph.
Attributed infrastructure
None published. WhisperGraph carries no ATTRIBUTED_TO edge to Gloo today — this states the absence of a published link, not that Gloo has no infrastructure.
References
- https://newrepublic.com/article/179397/evangelical-app-targeting-immigrants-surveillance
- https://www.patheos.com/blogs/keithgiles/2024/05/they-exploit-us-updating-he-gets-us-and-gloo-article/
- https://www.patheos.com/blogs/keithgiles/2024/05/betrayal-from-he-gets-us-to-he-tricked-us/
- https://finance.yahoo.com/news/gloo-announces-ai-licensing-platform-231400951.html
© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Related pages
Pivot from Gloo into its techniques, tactics and any attributed infrastructure.
Queries
Resolves the slug to this actor, merging every duplicate node sharing the same name.
MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
a.references AS references, a.campaigns AS campaigns
LIMIT 25Techniques this actor uses, grouped by the tactic each one serves.
MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000Infrastructure publicly attributed to this actor.
MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25Or query Whisper from your own LLM workflow via the Whisper MCP server.