Lov3rDns

Profile narrative

Lov3rDns is the alias used by a threat actor who has been identified in open‑source reporting as a Yemeni hacker, although the contextual note associated with the actor lists the United States of America as the known location. The actor first came to public attention in July 2015 when they compromised and defaced the official social‑networking domain of Barack Obama’s presidential campaign, replacing the content with a political message that demanded Yemen’s sovereignty and displayed the South Yemen flag. Prior to this incident, the same actor had been credited with a series of breaches against a range of organizations, including AVG Security, MIT, the McAfee portal, the Coca‑Cola website, a Joomla blog, Kaspersky, Avast security, Firefox, and MSN Portugal domains. These historical intrusions demonstrate a pattern of targeting both technology and security firms as well as consumer‑facing brands.

The actor’s targeting appears to span multiple sectors, notably government‑related online platforms, corporate websites, and security‑vendor infrastructures, with observed activity affecting entities in the United States, Yemen, and Saudi Arabia. The strategic objective evident from the Obama campaign defacement is the dissemination of a political message through high‑profile digital disruption, rather than financial gain or espionage, as the actor explicitly used the compromised site to broadcast a demand concerning Yemen’s sovereignty. The reporting does not attribute any financial motive or data‑theft goal to these actions, focusing instead on the actor’s use of website defacement as a means to convey a geopolitical statement. No mention is made of ransomware, data exfiltration, or covert intelligence collection in the available sources.

Regarding tactics, techniques, and procedures, the only confirmed method described is the defacement of web servers, specifically the uploading of a deface page to a subdirectory path such as /page/file/ on the compromised domain, accompanied by a political statement and a flag image. No malware families, exploit kits, phishing vectors, or command‑and‑control infrastructure are referenced in the provided material. Attribution to any state sponsor or formal criminal consortium is not explicitly established in the sources; while the actor’s activities have been mentioned alongside claims by the Yemen Cyber Army concerning a breach of the Saudi Ministry of Foreign Affairs server, the texts do not definitively link Lov3rDns to that group. Consequently, the profile is limited to the confirmed facts of the alias, the reported location, the observed defacement incidents, the list of previously targeted organizations, and the noted political motivation behind the Obama campaign compromise.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.