Cyber Threat Actor: Rekan Error

The threat actor is known by the aliasesRekan Herror and Rekan Error and has been publicly associated with locations in the United States of America. These identifiers appear in reporting that links the actor to a series of website defacements carried out in March 2017. No additional personal details or organizational affiliations have been disclosed in the available sources.

The actor’s targeting has focused on publicly accessible websites belonging to individuals in the entertainment and sports sectors, specifically the official site of the American girl group Fifth Harmony and the personal sites of Olympic champion Scott Hamilton and musician Chelsea Bain, all of whom are based in the United States. The defacements replaced normal content with a Kurdish flag, the actor’s Gmail address, and explicit statements condemning ISIS and Turkey, indicating that the primary objective was to convey a political message rather than to pursue financial gain or espionage. The repeated use of identical defacement pages across multiple victims suggests a coordinated effort to amplify a specific ideological stance.

Observed tactics, techniques, and procedures involve the deployment of a static defacement page that includes a Kurdish flag, a contact email address, and scripted anti‑ISIS/Turkey language; no malware families, exploit kits, or advanced tooling have been referenced in the reporting. The actor’s initial access method is not described in the sources, and no evidence of persistence mechanisms, command‑and‑control infrastructure, or post‑exploitation activities has been presented. The activity is limited to the visible alteration of web content and the留存 of contact information for potential communication.

Attribution in open‑source reporting identifies the actor as a Kurdish hacker sympathizing with Kurdish nationalist causes, particularly opposition to ISIS and Turkish state actions; no state sponsorship, criminal consortium, or broader affiliations have been explicitly established. The most notable operation attributed to Rekan Error is the March 2017 defacement campaign against the Fifth Harmony, Scott Hamilton, and Chelsea Bain websites, which was quickly noticed by fans and resulted in the restoration of the compromised sites within a few hours. This incident aligns with earlier defacements by Kurdish hackers that similarly employed political messaging against extremist groups and state actors. The actor’s known activity remains confined to these politically motivated website defacements, with no further publicly reported operations detailed in the provided material.