X-saad

Profile narrative

The threat actor is known by the alias X‑saad and has been referenced in open‑source reporting as operating from the United Kingdom. No additional names or alternate handles have been publicly associated with this actor in the available material. The actor’s geographic base is noted only as the United Kingdom, with no further detail on city or region provided. No public information links X‑saad to any specific organization, group, or ideological movement beyond the single incident described. The absence of alternative identifiers means that the actor’s profile rests solely on the alias and the stated location.

On 6 January 2015, X‑saad claimed responsibility for defacing the website of Sowerby Primary School in Thirsk, North Yorkshire. The compromised site displayed an image that showed the United States and Israeli flags each marked with a cross, accompanied by a statement asserting the hack. The school responded by posting a reassurance message on Twitter to inform parents that the incident was under control and that normal service would be restored shortly. North Yorkshire Police confirmed that they were investigating the unauthorized access and alteration of the site, treating it as a criminal matter. The defacement remained visible for a short period before the school’s administrators regained control and restored the original content. No further disruption or data loss was reported by the school or law‑enforcement agencies in connection with this event. This episode constitutes the only publicly reported operation linked to X‑saad in the source set.

No technical details regarding the intrusion method, malware families, or specific tools used by X‑saad have been disclosed in the reporting. Consequently, no particular initial access vector, exploit, or payload can be attributed to the actor based on the current information. Likewise, no public attribution ties X‑saad to a state sponsor, criminal organization, or any broader campaign beyond the single school website incident. The absence of further incidents or associated indicators limits the ability to describe a pattern of behavior, sectoral focus, or strategic objective beyond the observed website defacement. Therefore, the profile of X‑saad remains confined to the confirmed facts of the alias, United Kingdom location, and the 2015 defacement of Sowerby Primary School’s website.

Incidents

Attributed incidents are available to members.