Cyber Threat Actor: ImaSadiq

The threatactor is publicly identified by the alias ImaSadiq. Open‑source articles link this alias to activity that originated from Nigeria. No alternative names or additional aliases have been disclosed in the available sources.

On 23 January 2015 the actor focused on the blog site maintained by the Nigerian Defence Headquarters. This blog operates as an online platform where the defence headquarters publishes statements and updates. The blog site is accessible to anyone with an internet connection, allowing broad public consumption of its content. The incident involved a front‑end defacement, which means the visible web pages presented to visitors were altered. The underlying databases that store the site’s content were reported to remain secure and unaffected. After the breach was detected, the website was restored to its original appearance within a short time frame. Restoration typically involves removing the altered files and replacing them with clean backups from a secure source.

Investigators noted that the attack trace led back to the hosting provider’s infrastructure, indicating the actor exploited weaknesses in that environment. The method used did not involve compromising the site’s application code directly. The individual using the ImaSadiq alias publicly claimed responsibility for the defacement shortly after the incident. The claim was subsequently removed from the forum where it had been posted.

The Nigerian Defence Headquarters' blog service serves as the military’s primary information channel for counter‑terrorism communications. It is relied upon to disseminate official updates regarding security operations to the public and media. Reporting highlighted that the site was selected because of its operational significance in national security reporting. The defacement therefore impacted a platform used to convey important defence‑related information to audiences.

No further campaigns, malware families, or custom tooling have been publicly associated with ImaSadiq in the material examined. Attribution to any state sponsor, criminal syndicate, or other organized group remains unverified. As a result, the current knowledge of the actor is limited to the single documented website defacement event from January 2015.