Cyber Threat Actor: Mamad Warning

Mamad Warning, also referred tosimply as Mamad, is an Iranian‑linked threat actor that has claimed responsibility for a series of website defacements targeting local government entities in the United States. The actor’s aliases appear in defacement messages alongside the phrase “Iranian Hackers,” and the group’s known location is Iran, although no independent verification of state sponsorship has been presented in open sources. Observed activity focuses on compromising publicly accessible web portals, such as county circuit clerk sites and municipal water department payment pages, with the apparent goal of disrupting service and projecting a political message rather than stealing data or pursuing financial gain. Officials from the affected jurisdictions confirmed that personal information remained isolated on separate systems protected by firewalls, noting that no resident data was compromised despite the visible alterations.

The actor’s primary technique involves defacing the compromised website by replacing its content with a graphic that combines a Guy Fawkes mask and, in some cases, the Iranian flag, accompanied by text that claims responsibility and warns visitors that their identity is known. In the Macon County incident the mask image was clickable and redirected users to the attackers’ Instagram profile, while the Murfreesboro Water Department defacement displayed the flag and mask side by side with the same claim of responsibility. No references to malware families, exploit kits, or specific intrusion tools appear in the reporting, indicating that the actor likely relies on readily available web‑application vulnerabilities or weak credentials to gain administrative access to the targeted sites. The defacements are accompanied by brief taunting messages but no evidence of data exfiltration or persistent backdoors has been reported, and the disruptions were limited to temporary loss of online functionality until the sites were restored by local IT staff.

Attribution remains uncertain because the actor’s statements are self‑declared and no independent technical evidence links the operations to an Iranian state agency or a recognized criminal consortium; consequently, any claim of state nexus is considered unverified by public sources. The two most prominently documented operations are the August 2019 defacement of the Macon County Circuit Clerk website in Illinois and the August 2019 compromise of the Murfreesboro Water Department bill‑payment portal in Tennessee, both of which followed a similar pattern of symbolic imagery and service disruption. Additional reporting notes that earlier in the same month other local government sites, including Randolph County, Crook County government and sheriff’s office, experienced comparable defacements attributed to Iranian‑linked actors, suggesting a broader campaign of opportunistic disruption against U.S. municipal online assets during that period. These incidents collectively illustrate the actor’s focus on publicity‑driven website vandalism rather than espionage, financial theft, or sustained network intrusion.