Cyber Threat Actor: MuslimLeets (aka Muj4hida)

The threat actor known as MuslimLeets (also using the alias Muj4hida) operates from the United States. This individual gained attention in September 2016 for a coordinated cyberattack campaign targeting the American Human Rights Council (AHRC) and 62 additional websites hosted by Novocam. The attacks primarily involved website defacements, with compromised sites displaying messages calling for jihad and urging Muslims to reject Western culture while returning to religious fundamentals. The affected entities spanned multiple sectors, including human rights organizations (specifically AHRC, the American Muslim Leadership Council, and the Arab and Muslim American Political Action Committee), as well as businesses operated by doctors, lawyers, and real estate firms. The actor’s strategic objective centered on ideological disruption, aiming to intimidate targets and spread fear through visible digital vandalism.

The attacks exploited server access vulnerabilities, with Novocam confirming the breach originated through AHRC’s infrastructure before propagating to other sites on the same server. MuslimLeets left grammatically flawed English-language defacement messages across compromised websites, framing the actions as a response to global conflicts affecting Muslim populations. Novocam described this incident as one of the most sophisticated attacks against their infrastructure despite frequent hacking attempts, requiring seven network administrators to investigate. The campaign occurred between September 14–16, 2016, affecting 63 websites before Novocam destroyed the compromised server and restored backups. No malware families or additional tooling were explicitly referenced in public reporting. The actor’s operational focus on high-visibility defacements aligns with objectives of psychological intimidation rather than financial gain or data theft.