Cyber Threat Actor: X-saad

X-saad is the known alias used by a threat actor whose activity has been publicly recorded. Open‑source reporting indicates the actor is associated with the United Kingdom. The only documented incident attributed to X‑saad occurred on 6 January 2015. On that date the website of Sowerby Primary School in Thirsk, North Yorkshire was compromised. The defacement replaced the normal site content with an image showing the United States and Israeli flags crossed out. Accompanying the image was a message claiming responsibility for the hack by the entity identifying itself as X‑saad. The school responded by posting reassurance to parents on its Twitter account. North Yorkshire Police confirmed that they were investigating the unauthorized access and site defacement. No further technical details about the compromise were disclosed in the public reports. The incident is therefore classified as a website defacement rather than a data breach or malware deployment.

Beyond this single defacement, no additional publicly reported operations, campaigns, or victim sectors have been linked to X‑saad. Consequently, there is no evidence in open sources to describe the actor’s typical targeting patterns, geographic focus, or strategic objectives such as financial gain, espionage, or disruption. Likewise, no specific malware families, initial‑access vectors, or tooling styles have been referenced in connection with X‑saad. Attribution to any state sponsor, criminal consortium, or hacktivist collective has not been established in the available material. Because the public record contains only this one event, any profile of X‑saad must be limited to the confirmed facts of the 2015 school website defacement. Further insight into the actor’s capabilities, motivations, or future activity would require additional information that is not presently available.