Cyber Threat Actor: Dr.Mezo0

Dr.Mezo0 is an alias used by an individual who has been publicly linked to the Anonymous Rabaa Team, a hacktivist collective that emerged around the mid‑2010s. The actor’s known identity is limited to this pseudonym, and no further personal details such as real name, age, or nationality have been disclosed in open sources. The alias appeared in connection with a website defacement operation that targeted a Costa Rican government entity in December 2015. No other aliases or separate online handles have been attributed to Dr.Mezo0 in the available reporting.

The defacement carried out by Dr.Mezo0 and teammates focused on the Costa Rican Ministry of the Environment’s web presence, a sector that deals with environmental policy, conservation areas, and related public information. The operation was directed at a Central American government institution, indicating a geographic focus on Costa Rica and a thematic interest in entities associated with natural heritage sites such as Cocos Island. The stated purpose of the action was to raise awareness of a political cause rather than to pursue financial gain, espionage, or sustained disruption; the attackers replaced official content with a video depicting the Rabaa Square Massacre and accompanying statements, then displayed links to their social media profiles. No evidence suggests that the actors attempted to exfiltrate data, install persistent malware, or manipulate internal systems beyond the surface-level defacement.

Technically, the incident relied on exploiting a vulnerability in the ministry’s web server to gain unauthorized access to the site’s content management interface, allowing the attackers to overwrite existing pages with their own media. The tooling observed consisted of publicly available defacement scripts and the embedding of a video file, indicating a reliance on straightforward web‑based intrusion techniques rather than custom malware or advanced persistence mechanisms. Affiliation-wise, Dr.Mezo0 operated under the banner of the Anonymous Rabaa Team, which has been described in some reports as having loose associations with individuals who previously participated in ISIS‑linked cyber activities; however, the defacement itself contained no pro‑ISIS messaging, and any direct state or criminal consortium linkage remains unverified in public sources. The group's actions appear opportunistic, leveraging a discovered weakness to convey a political message without attempting deeper network compromise.

The December 24, 2015 defacement of the Costa Rican Ministry of the Environment website stands as the sole publicly documented operation attributed to Dr.Mezo0, serving as a representative example of the actor’s typical approach. This episode illustrates a pattern of targeting government web properties to disseminate politically motivated content, employing simple exploitation methods to achieve visibility, and refraining from data theft or destructive payloads. While the actor’s broader capabilities, motivations, or subsequent activities are not detailed in the open record, the incident confirms a willingness to use website defacement as a tool for advocacy within a specific regional and sectoral context. No further incidents involving Dr.Mezo0 have been reported in the sources consulted.