Cyber Threat Actor: YMH

The threat actor knownby the alias YMH has been linked to a series of website defacements targeting Egyptian government institutions in March 2014. The actor’s location is reported as Yemen in the source material. The primary targets identified include the Egyptian Armed Forces Training Authority, the Tourist Development Authority, and the Military Technical College. These targets span the defense, tourism, and military education sectors within Egypt. The defacements were carried out by gaining unauthorized access to the web servers and replacing the legitimate content with a message written in Arabic. The posted message urged visitors to set aside political disagreements and enjoy a cup of tea, reflecting a neutral stance rather than support for any specific faction. A translated version of the message reads: “Owned by Ymh! We don’t know with whom to fight, el Sisi or the Muslim Brotherhood, leave all the politics behind and enjoy yourselves a little with the tea of Om Hasan (symbol of the reversed revolution).” The defacement did not express overt support or opposition to any political faction but instead promoted a neutral stance, urging visitors to disregard political tensions.

In addition to the Armed Forces Training Authority incident on 31 March 2014, the same YMH actor had previously defaced the Tourist Development Authority and the Military Technical College on 23 March 2014, using a nearly identical defacement page and message. At the time of reporting, the Armed Forces Training Authority site remained offline while the other two sites had been restored following the earlier incidents. No publicly available information attributes the actor to a state sponsor, criminal organization, or any specific ideological group. The available sources describe only website defacement and do not mention malware, exploit kits, or other tooling. The defacement messages urged visitors to leave politics aside and enjoy tea, referencing the tea of Om Hasan as a symbol of the reversed revolution. The March 2014 defacement campaign represents the only publicly documented activity associated with the YMH alias. The actor’s activity is limited to these three defacements, with no further incidents reported in the open sources. The defaced content was replaced with a message that referenced political disengagement and tea culture.