Cyber Threat Actor: Dr.No0oS

Dr.No0oS is an alias used by an individual associated with the hacktivist collective known as the Anonymous Rabaa Team, which emerged from Egyptian activist circles. The actor has been publicly linked to operations that combine website defacement with political messaging, leveraging online platforms to broadcast statements and multimedia content. While the alias appears in threat intelligence feeds, the concrete evidence of activity comes from a single documented incident in which the actor participated as part of a larger group. No additional aliases or separate operational identities have been verified in open sources beyond those already mentioned.

The defacement attributed to Dr.No0oS and the Anonymous Rabaa Team targeted the Costa Rican Ministry of the Environment, a government entity responsible for environmental policy and conservation areas in Central America. The attack replaced official content with a video depicting the Rabaa Square Massacre and an accompanying statement, aiming to draw international attention to a specific political cause rather than to extract data or generate profit. This indicates a strategic objective centered on disruption and awareness‑raising, with no evidence of financial gain, espionage, or persistent access to the compromised systems. The geographic focus of the known operation is limited to Costa Rica, reflecting an opportunistic choice of target based on perceived vulnerability and diplomatic relevance.

Technically, the operation relied on exploiting a web‑application vulnerability to gain unauthorized editing privileges, allowing the attackers to upload multimedia files and insert hyperlinks to their social media profiles. No malware families, custom tools, or sophisticated payloads were reported in the public account of the incident, suggesting a reliance on readily available defacement techniques rather than advanced persistent threat capabilities. Attribution to a state sponsor has not been established; instead, the actor is described as part of a loosely affiliated hacktivist network with reported, though unconfirmed, historical ties to certain extremist‑sympathetic cyber groups, a connection that did not manifest in the messaging of this particular campaign. The 2015 defacement of the Costa Rican ministry website remains the sole publicly cited operation that illustrates the actor’s typical approach of combining symbolic vandalism with political advocacy.