Cyber Threat Actor: Crazy-3r3r

The threat actor isknown by the aliases Mr.Xpr! and Crazy-3r3r, with an indicated location in Saudi Arabia when known. Mr.Xpr! has been publicly linked to the Iran Hack Security Team, while Crazy-3r3r is described as a Saudi hacker who has previously targeted UAE police websites. These aliases appear in separate incidents that attribute the actor to both Iranian and Saudi cyber activities, reflecting a cross‑border pattern of attribution in the sources. No additional affiliations or state sponsorship are explicitly stated beyond the team association for Mr.Xpr! and the national origin implied for Crazy-3r3r.

The actor’s targeting has focused on government and military web properties in the Middle East, including Iran’s Supreme Leader blog, the Royal Saudi Air Force site, and UAE police domains. The stated objectives in the reported operations are political protest rather than financial gain; Mr.Xpr! cited opposition to the Saudi‑led war in Yemen as the motive for the Air Force intrusion, whereas Crazy-3r3r’s defacement of the Iranian leader’s blog was framed as a response to regional tensions following the execution of a Shiite cleric. These actions align with a broader pattern of reciprocal cyber incidents between Iranian and Saudi actors described in the articles. No evidence of espionage, financial theft, or data exfiltration is presented in the supplied material.

The observed tactics involve web defacement and the posting of protest messages, with proof of intrusion provided via zone‑h mirrors. No specific malware families, exploit kits, or advanced tooling are mentioned in the sources; the actor’s method appears to rely on gaining unauthorized access to web servers and replacing or overlaying content with political imagery or text. Notable operations include the August 2015 hack of the Royal Saudi Air Force website where the message “Hacked By Mr.Xpr! Iran Hack Security Team” was left, and the January 2016 defacement of Iran’s Supreme Leader blog by Crazy-3r3r, which displayed an image of a Saudi fighter jet carrying an Iranian leader. Earlier activity by Crazy-3r3r reportedly involved the defacement of Abu Dhabi police‑related sites in 2013, establishing a recurring use of website alteration as a means of signaling dissent. The profile ends here with the facts drawn exclusively from the provided sources.