Anonymous Rabaa

Profile narrative

Anonymous Rabaa, also known as Anonymous Rabaa Team, is a hacktivist group that operates from Egypt and aligns itself with the broader Anonymous collective. The group uses the aliases Anonymous Rabaa and Anonymous Rabaa Team in its public statements and communications. It has presented itself as a voice for protesters who were killed during the 2013 Rabaa Square crackdown in Cairo. Public attributions consistently link the group to Egyptian‑based activists rather than to any state sponsor or criminal organization.

The actors primarily target government web properties, focusing on ministries, presidencies and information portals within Egypt, as demonstrated by the coordinated actions against multiple Egyptian sites in October 2015. Their activities have also extended to a single Costa Rican government website, the Ministry of the Environment, which was defaced in December 2015. The stated purpose of these operations is to raise awareness of perceived human rights abuses and to express solidarity with victims of state violence, rather than to pursue financial gain or espionage. No public source attributes a profit‑motive or intelligence‑gathering goal to the group.

Technically, the group relies on straightforward website defacement techniques, exploiting publicly known vulnerabilities to replace or overlay content on the target’s public‑facing pages. Their defacements have included embedded videos of the Rabaa Square massacre, written statements, protest symbols such as the four‑fingered Rabaa sign, and links to social‑media pages where they share additional material. Analyses of the incidents note that no databases were accessed, no data was exfiltrated, and the impact was limited to temporary visual alteration and brief service disruptions. No custom malware, exploit kits, or advanced tooling has been reported in connection with their operations.

Two representative campaigns illustrate their pattern: the October 22, 2015 wave of defacements that hit the Egyptian presidency, several ministries, the Center for Information and Decision Support, the Supreme Council of the Press and other government portals, all accompanied by protest messages and temporary outages; and the December 24, 2015 defacement of the Costa Rican Ministry of the Environment’s conservation‑area pages, which displayed a video of the Rabaa Square massacre and a statement from the attackers. Both actions were claimed by Anonymous Rabaa, emphasized political motivation, and resulted in no reported compromise of underlying systems or data.

Incidents

Attributed incidents are available to members.