SYRIAN CYBER

Profile narrative

The threat actor is known by the aliases Mr.Rocky and SYRIAN CYBER and has been associated with activity originating from Saudi Arabia. The only publicly documented operation linked to this actor occurred on August 15 2014, when the Saudi state television website Alikhbaria was defaced. The attackers posted anti‑government messages and imagery, including a altered photograph of King Abdullah crossed out in red, and stated that the breach was intended as a show of solidarity with political prisoners detained in the country. This incident disrupted the normal broadcasting service of the targeted outlet and served as a public platform for the actor’s expressed dissent.

The defacement of Alikhbaria represents the actor’s observed targeting of a media organization within Saudi Arabia, indicating a focus on governmental communication channels in that region. No additional sectors, geographic patterns, or recurring targets have been identified in the available sources. The actor’s stated purpose for the attack was to broadcast solidarity with imprisoned individuals, which constitutes a politically motivated objective rather than a financial or espionage‑driven one. No malware families, exploit tools, initial access vectors, or specific technical techniques were referenced in the reporting of this event, so no TTP details can be confirmed.

Because the public record contains only this single incident, there is no evidence to support claims of broader campaigns, affiliations with state sponsors, or involvement in criminal consortia. The actor’s capabilities, size, or sophistication remain unspecified, and any further characterization would require information not present in the provided material. Accordingly, the profile is limited to the confirmed facts of the aliases, the location association, the 2014 defacement of Alikhbaria, and the actor’s own claim of acting in solidarity with political prisoners.

Incidents

Attributed incidents are available to members.