Cyber Threat Actor: Rexer Hacker

The threat actor known as Rexer Hacker, also referenced as RxR HaCker, operates from Saudi Arabia. The actor gained public attention for defacing the Iranian Ministry of Defense recruitment website on May 7 2015. The compromised domain belonged to the Gozinesh department, which manages job placement for religious and ethnic minorities within Iran's defense sector. During the intrusion the actor replaced the site's content with a defacement page that displayed an image of Saudi King Salman bin Abdulaziz Al Saud. The accompanying message, provided in Arabic with an English translation, criticized Iran's supreme leader Ali Khamenei and referenced the Yemen conflict while asserting that Saudi Arabia would oppose any opposition to Yemen. The actor framed the act as a political statement intended to affirm Saudi influence in the region and to condemn perceived Iranian interference in Yemen.

The defacement illustrates the actor's typical approach of gaining unauthorized access to a web presence and substituting its content with a politically motivated statement, indicating reliance on website defacement as a primary tactic. The reporting does not describe any specific malware families, exploit tools, or initial access vectors associated with this intrusion. A prior operation mentioned in the same source notes that on April 13 2015 the actor, or actors aligned with the same narrative, compromised Iran state TV social media accounts in support of Saudi Arabia's position in the Yemen war. The reporting does not mention data theft, financial gain, or destructive payloads linked to either incident. The actor is identified solely as an individual hacker based in Saudi Arabia, with no public evidence linking them to a state sponsor, criminal group, or larger consortium. Consequently, the known profile consists of politically motivated website defacements targeting Iranian government assets within the broader context of regional tensions between Saudi Arabia and Iran.