Cyber Incident Victim: Aldoriyah Principality
Date:
Jan 2014
Location:
Saudi Arabia
Summary
The Syrian Electronic Army compromised 16 Saudi Arabian government websites, targeting administrative regional domains under the banner #ActAgainstSaudiArabiaTerrorism. Attackers defaced pages with messages condemning the Al Saud regime for allegedly supporting terrorist groups, prompting the victim to take impacted sites offline. Concurrently, the group announced plans for continued cyber operations against Microsoft despite their own website being temporarily disabled by Turkish hackers. SEA maintained that future activities would be coordinated through social media while seeking new hosting infrastructure.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 16, 2014, hackers affiliated with the Syrian Electronic Army (SEA) breached and defaced 16 Saudi Arabian government websites representing various administrative regions, referred to as principalities. The attackers replaced legitimate content with a political message condemning the Al Saud regime, accusing it of utilizing terrorist groups for its objectives. This campaign was branded with the hashtag #ActAgainstSaudiArabiaTerrorism, explicitly linking the operation to broader geopolitical grievances. The defacement served as the primary visible action, disrupting normal website functionality and public access. Administrators responded by taking all impacted websites offline to contain the incident and prevent further unauthorized access or dissemination of the hackers' message. At the time of the article's publication, the sites remained inaccessible, indicating ongoing remediation efforts.
The SEA simultaneously faced operational challenges unrelated to this incident, as their own website had been compromised by the Turkish hacker group Turkguvenligi through a hosting provider vulnerability. This forced the SEA’s official site offline until they could secure alternative hosting. Despite this setback, the group publicly affirmed via social media that their offensive operations, including potential future attacks against unspecified targets, would continue uninterrupted. They committed to providing updates exclusively through their social media channels while their primary website remained inactive. The Saudi website defacements demonstrated the SEA’s sustained capability to execute coordinated attacks against government digital assets, leveraging web vulnerabilities to achieve ideological messaging objectives despite facing counter-hacking activities against their own infrastructure.