Mamad Warning

Profile narrative

The threat actor known as Mamad Warning, also referred to simply as Mamad, has been observed conducting website defacements against local government entities in the United States. The actor uses the alias Mamad Warning in claim messages and has been linked to incidents in Macon County, Illinois and Murfreesboro, Tennessee. Open‑source reporting indicates the actor is based in Iran, although no official confirmation of state sponsorship has been provided. The targeting appears limited to municipal websites that provide public services such as circuit clerk functions and water bill payment portals.

In each observed incident the actor replaced the target site’s homepage with a graphic featuring a Guy Fawkes mask accompanied by an Iranian flag. Below the image the defacement included text stating “Hacked by Iranian Hackers” and “Hacked by Mamad Warning.” Visitors who clicked the mask image were redirected to an Instagram profile controlled by the attackers. No malware payloads or exploit tools were described in the reports, and the actors did not attempt to exfiltrate or encrypt data. The defacements resulted in temporary disruption of the affected online services until administrators restored the original content.

Attribution to Iran rests on the actor’s self‑identification as Iranian hackers and the geographic location noted in threat intelligence summaries, but public sources do not present concrete evidence of direct state direction or support. The two defacements in August 2019 represent the only publicly reported operations attributed to Mamad Warning, with no subsequent campaigns documented in the available material. Following the incidents, the affected entities confirmed that personal data remained isolated on separate systems and that no breach of sensitive information occurred. The actor’s activity remains characterized by low‑level website vandalism rather than sophisticated intrusion or financial gain.

Incidents

Attributed incidents are available to members.