Cyber Threat Actor: aLem!

The threat actor is known by several aliases, including aLem!, VirtuaL, Darkwar and DARKWAR2, and open‑source reporting indicates the individual is based in Turkey. The alias aLem! appears in the 2016 defacement of Arizona state government sites, while VirtuaL and DARKWAR2 were used in the 2014 compromise of Manila’s official portal. The actor has been linked publicly to the Turk Hack Team, a hacker collective with which the individual has collaborated since at least 2007. Reporting notes that the actor’s defacement activity spans from 2007 through 2016, demonstrating a multi‑year involvement in website disruption operations.

Targeting has focused on government‑owned web properties in the United States and the Philippines. In the 2016 incident the actor defaced the Arizona State website, the Arizona House of Representatives site and the Arizona Legislature site, replacing each homepage with an anti‑United States message and a logo of the Turkish football club Eskişehirspor. In the 2014 incident the actor, using the aliases VirtuaL and DARKWAR2, compromised the official portal for the city of Manila, posting anti‑American, anti‑Israeli and anti‑United Nations rhetoric alongside explicit language and a call for freedom for Muslims. These defacements were reversed shortly after the breach, indicating a disruption objective aimed at conveying political statements rather than pursuing financial gain or espionage.

The two campaigns cited above represent the actor’s observed pattern: gaining unauthorized access to high‑profile government sites, uploading a custom defacement page that includes political messaging and symbolic imagery, and then restoring the sites after a short interval. No public sources disclose specific malware families, particular exploit tools or detailed initial‑access vectors; the only technical detail mentioned is that security controls were bypassed to allow the defacement. The actor’s affiliation with the Turk Hack Team is the only asserted connection to a larger group, and the sources do not document any state sponsorship or criminal‑consortium ties. The actor’s aliases and actions have been reported by outlets such as Hackread and MEMRI, with zone‑mirror proofs provided as evidence of the defacements.