Rexer Hacker

Profile narrative

The threat actor is known by the alias Rexer Hacker, also referenced in reporting as RxR HaCker, and is identified as operating from Saudi Arabia. This alias appears in defacement messages left on compromised Iranian web properties, where the actor signs their work with the handle Rexer Hacker. The actor’s location is explicitly stated in the available sources, placing them within the geographic context of Saudi Arabia. No additional aliases or alternative names are provided in the material.

The actor’s observed targeting focuses on Iranian government online assets, specifically the recruitment website of the Iranian Ministry of Defense and the social media accounts of Iranian state television. These targets are selected for their visibility and symbolic value within the Iranian public sector. The strategic objectives demonstrated in the incidents are political messaging and disruption, as the actor posted criticism of Iran’s leadership, displayed imagery of the Saudi king, and expressed support for Saudi Arabia’s position in the Yemen conflict. There is no indication in the sources of financial gain, espionage, or other motives beyond the stated political disruption.

The tactics, techniques, and procedures described are limited to website defacement and social media account compromise. The actor replaced the content of the Iranian Ministry of Defense recruitment site with a political message and an image of the Saudi monarch, and similarly gained control of Iranian state TV social media accounts to post supportive content. No malware families, specific initial access vectors, or particular tooling styles are mentioned in the reporting, so further technical detail cannot be inferred. Attribution is confined to the actor’s self‑identification as a Saudi hacker, with the sources linking the activity to the broader context of Saudi‑Iranian rivalry during the Yemen war; no explicit state sponsorship or criminal consortium affiliation is asserted publicly.

Representative operations include the May 7 2015 defacement of the Iranian Ministry of Defense recruitment website, where the actor posted a message criticizing Iran’s supreme leader and affirming Saudi influence over Yemen, and the earlier April 13 2015 compromise of Iranian state television’s social media accounts, conducted in support of Saudi Arabia’s Yemen campaign. Both incidents were reported as being restored shortly after the attacks, and they illustrate the actor’s pattern of using high‑profile Iranian government platforms to convey politically charged statements. These cases constitute the publicly documented activity associated with the Rexer Hacker alias.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.