Rekan Error
Attribution profile
- Type
- Activist
- Location
- United States of America
- Known incidents
- 1 incident
- Sources
- 1 source
- First seen
- 2017-03-11
- Last seen
- 2017-03-11
- Updated
- 2026-07-31 18:33
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Rekan Error, also known as Rekan Herror, is a hacker who has been publicly identified as operating from the United States of America. The actor uses the online handle “Rekan Error” in defacement incidents and is described in reporting as a Kurdish hacker. Public sources link this alias to a series of website defacements that occurred in March 2017, targeting the online presences of American entertainment figures. No further personal details such as real name, age, or organizational affiliation have been disclosed in the available material.
The actor’s observed targeting focuses on websites belonging to music and television personalities, specifically the official site of the girl group Fifth Harmony, the site of Olympic champion and TV broadcaster Scott Hamilton, and the site of musician Chelsea Bain. All three victims are based in the United States, indicating a geographic focus on domestic online assets. The defacements replaced normal content with a Kurdish flag, the hacker’s Gmail address, and explicit statements condemning the Islamic State and Turkey, demonstrating a clear intent to convey political messages rather than to pursue financial gain or espionage. The repeated use of identical defacement pages across multiple victims suggests a goal of disruption and publicity for a cause, specifically a pro‑Kurdish, anti‑ISIS and anti‑Turkey narrative.
In terms of tactics, the actor’s methodology consists of gaining unauthorized access to web servers to upload a defacement page, a technique that does not rely on malware families or sophisticated tooling as described in the sources. The same defacement page, containing the Kurdish flag, contact information, and political slogans, was deployed on each compromised site, indicating a consistent tooling style centered on simple web‑based defacement. Attribution to a broader state sponsor or criminal consortium is not established in the reporting; the actor is characterized as a Kurdish hacktivist acting in line with a pattern of similar protests by Kurdish hackers against ISIS and Turkish interests. The March 2017 defacement of the Fifth Harmony, Scott Hamilton, and Chelsea Bain websites serves as a representative example of the actor’s publicly reported operations, illustrating the combination of website disruption and ideological messaging that defines their observed activity.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 1 source.