Cyber Threat Actor: Mr.Rocky

The threat actor is known by the alias Mr.Rocky. Open source reporting indicates the actor is based in Saudi Arabia. No other aliases or personal identifiers have been publicly disclosed for this individual.

On August 15, 2014, the actor, operating under the banner SYRIAN CYBER, compromised the website of Saudi state television Alikhbaria. The defacement replaced the normal homepage with anti‑government messages and imagery. A prominent element of the altered page was a photograph of King Abdullah that had been crossed out in red. The attackers asserted that the act was intended to show solidarity with political prisoners detained within the country. The disruption prevented normal broadcasting operations from functioning as usual during the incident. The incident was described by the attackers as a public demonstration of opposition to Saudi authorities. No evidence has been presented linking the defacement to any malware deployment or data exfiltration. The incident involved a website defacement. No details about the specific vulnerabilities exploited or the tools employed have been made public.

Public sources do not associate Mr.Rocky with any known state‑sponsored group, criminal consortium, or larger hacking collective. Likewise, there is no publicly available information regarding the actor’s typical targets, preferred sectors, or strategic objectives beyond this single event. Consequently, the actor’s technical capabilities, motivation beyond the stated claim, and any subsequent activities remain undocumented in open‑source reporting.

As a result, the only verifiable footprint of Mr.Rocky in the threat landscape is the August 2014 Alikhbaria defacement. This single episode constitutes the entirety of the publicly known activity attributed to the alias. No further incidents or attributions have been reported that can be confidently linked to Mr.Rocky. The actor therefore remains a low‑profile figure whose known actions are limited to that one website defacement. Any assessment of broader patterns or affiliations would require additional evidence that is not currently available.