Cyber Incident Victim: Embassy of India in Greece
Date:
Jun 2016
Location:
Turkey
Summary
Pakistani hackers defaced the Embassy of India in Greece's website along with six other Indian embassies and a police station, displaying pro-Pakistan messages and claiming affiliation with the Pakistan Army. The attackers, identified as "Romantic" and "Intruder," taunted Indian authorities, while another hacker from Team Pak Cyber Attackers targeted the Karnataka State Police site. All affected websites were subsequently restored. This incident reflects the persistent cyber conflict between Indian and Pakistani hacker groups, rooted in historical geopolitical tensions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 3 actors | Available to members | Available to members |
Description
Between June 11 and June 13, 2016, a coordinated cyberattack targeted multiple Indian government websites, including the Embassy of India in Athens, Greece. Pakistani hackers using the aliases "Romantic" and "Intruder" defaced seven Indian diplomatic mission websites across Turkey, Greece, Mexico, Brazil, Romania, Tajikistan, and South Africa. The attackers replaced website content with a message declaring "Embassy of India in Dushanbe, Tajikistan Has Been OWNED" while taunting the Indian government with the phrase "Do not Mess With Us Pakistan Army Zindabad." The defacement included the Pakistani flag and statements glorifying Pakistan's military, specifically using the slogan "Pakistan Zindabad! Feel The Power of Pakistan." Simultaneously, a separate hacker named Faisal 1337 from Team Pak Cyber Attackers compromised the Karnataka State Police website, displaying similar nationalist imagery and offensive content. All affected websites became temporarily inaccessible to legitimate users during the defacement period.
This incident occurred against the backdrop of ongoing cyber hostilities between Indian and Pakistani hacking groups dating to territorial conflicts originating in 1947. The attack mirrored previous patterns observed in January 2016 when Indian hackers retaliated against Pakistani websites following the Pathankot airbase terrorist attack. Forensic investigations confirmed the defacements as website intrusions rather than data breaches, with no evidence of stolen information. Authorities restored all compromised sites to operational status shortly after detection. The incident represented one component of broader cyber operations between the nations, including contemporaneous campaigns like Operation Transparent Tribe and BreachRAT malware attacks targeting Indian military personnel. No group claimed financial motives, with all messages emphasizing geopolitical antagonism and symbolic disruption of Indian government online presence.