Cyber Threat Actor: Faisal

The threat actor is known by the alias Faisal. Faisal is based in Pakistan. In open‑source reports Faisal has claimed affiliation with the group Team Pak Cyber Attacker. On 27 September 2015 Faisal defaced the official website of the Kerala government in India. The defacement replaced the site’s normal content with an image of a burning Indian flag accompanied by messages that mocked the website’s security. The act was carried out as a website defacement, a technique that exploits web application vulnerabilities to gain unauthorized edit access without deploying malware. The defacement was intended to convey a political statement and to disrupt the availability of the target’s online presence.

Following the incident, Indian hacking collectives including Mallu Cyber Soldiers, Team Hind Hackers, and Hell Shield Hackers launched retaliatory operations. Those retaliatory campaigns compromised more than forty Pakistani government and educational websites. The retaliatory defacements displayed burned Pakistani flags and included taunting messages that referenced the Kerala incident as motivation. The Kerala government’s website became temporarily inaccessible after the defacement but suffered no damage to its underlying servers. Restoration of the site was undertaken by Kerala’s data center, bringing the service back online after the outage. No official statements were issued by either the Indian or Pakistani governments regarding the exchange of defacements. Beyond this 2015 episode, no additional campaigns, tooling, or affiliations have been publicly attributed to Faisal.