Cyber Incident Victim: Embassy of India in Bucharest
Date:
Jun 2016
Location:
Romania
Summary
Pakistani hackers affiliated with the Pakistan Army, operating under aliases including "Romantic" and "Intruder," defaced multiple Indian diplomatic websites, including the Embassy of India in Romania, alongside embassies in Turkey, Greece, Mexico, Brazil, Tajikistan, and South Africa. The attackers replaced content with pro-Pakistan messages, military slogans, and taunts directed at the Indian government. Separately, a hacker from Team Pak Cyber Attackers defaced the Karnataka State Police website, displaying the Pakistani flag and offensive content. All affected sites were subsequently restored. This incident reflects ongoing cyber hostilities between Indian and Pakistani groups, historically linked to geopolitical tensions between the two nations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 3 actors | Available to members | Available to members |
Description
On or around June 11, 2016, Pakistani hackers conducted website defacements targeting multiple Indian government entities, including the Embassy of India in Romania. The attacks were attributed to two individuals using the aliases "Romantic" and "Intruder," who compromised seven Indian embassy websites globally. Affected diplomatic missions included those in Ankara (Turkey), Athens (Greece), Mexico City (Mexico), São Paulo (Brazil), Bucharest (Romania), Dushanbe (Tajikistan), and Pretoria (South Africa). Hackers replaced website content with a message proclaiming "Embassy of India in Dushanbe, Tajikistan Has Been OWNED," accompanied by taunts directed at the Indian government and declarations of allegiance to the Pakistan Army. The message included phrases such as "Pakistan Army Zindabad," "Salute To Pakistan Army," and "Feel The Power of Pakistan," concluding with "Pakistan Zindabad." In a separate but related action, a hacker identified as Faisal 1337 from Team Pak Cyber Attackers defaced the Karnataka State Police website, displaying the Pakistani flag and offensive content.
Authorities initiated investigations into all compromised websites following detection of the defacements. Technical teams restored affected sites to their operational versions, though the duration of downtime was not specified. This incident occurred within the context of persistent cyber hostilities between Indian and Pakistani hacking groups, with historical roots in geopolitical tensions dating to the countries' 1947 partition. Earlier in 2016, Indian hackers had retaliated against Pakistani websites following the Pathankot Air Force Station terrorist attack. The embassy defacements coincided with ongoing cyber-espionage campaigns between the nations, including documented operations involving BreachRAT malware, Operation Transparent Tribe targeting Indian officials, and Operation C-Major against military personnel. No data theft or persistent network access was reported in this specific defacement incident, which primarily caused temporary service disruption and reputational impact through visible website alterations.