Health and Human Services

Summary

A pro-ISIS hacking group operating from Morocco under the handle "Team System DZ" defaced multiple sites hosted on a server belonging to Richland County in Wisconsin. The attack impacted several local government and public-service websites, including the Sheriff's Department, the City of Richland Center municipality, the Parks Commission, the Ambulance Service, the county Fair and Recycling site, the Land Conservation department, and the Richland County Fitness Center. The attackers replaced the affected pages with a defacement message expressing support for ISIS and containing hostile language directed at Israel and the United States. All targeted sites were subsequently restored.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 21, 2015, a group identifying itself as Team System DZ, a pro-ISIS hacking collective operating out of Morocco, compromised the web server hosting multiple official websites belonging to Richland County, Wisconsin. The attackers defaced several high-profile sites simultaneously, including the Richland County Sheriff's Department website, the City of Richland Center Municipality site, the Parks Commission, the Ambulance Service, the Richland County Fair & Recycling page, the Land Conservation department, and the Richland County Fitness Center. The coordinated nature of the attack, hitting at least seven distinct county-related properties through what was reported as a single server compromise, indicated that the attackers had obtained access at the hosting or server level rather than compromising each individual website separately.

Once inside, the hackers replaced the legitimate content of the affected websites with a defacement page that carried a clear ideological message. The page displayed the header "Hacked by Team System Dz" and included a statement reading "I am a Muslim & I love jihad, I love ISIS," followed by hostile language directed at Israel and the United States. This defacement served both as a visible demonstration of the group's technical capability and as a propaganda action intended to spread the attackers' political and religious messaging through compromised government and public-service web properties. Because the targeted sites included law enforcement and emergency services, the attack carried an additional symbolic weight, with the Sheriff's Department and Ambulance Service among those visibly defaced.

The incident was documented through Zone-H mirrors, an independent archive commonly used to verify defacement attacks, providing external confirmation of the compromise across the multiple Richland County domains. The attack fit a broader pattern of pro-ISIS cyber activity targeting Western, particularly U.S.-based, government and public-facing websites in the months surrounding the incident. Earlier in 2015, in January, the Isle of Wight, Virginia website had been targeted, and in February 2015, the Newsweek Twitter account was compromised by ISIS-affiliated hackers. Days before the Richland County incident, a separate pro-ISIS group had leaked a list of United States military personnel, urging supporters within the country to act against those named, demonstrating that website defacement was part of a wider campaign of online operations.

In terms of response and containment, the article reports that, at the time of publication, all of the defaced Richland County websites had already been restored to normal operation. No details are provided about the specific technical remediation steps taken, such as how the server access was revoked, whether credentials were changed, whether the underlying vulnerability was patched, or whether any forensic investigation was conducted. There is also no mention in the source material of any data exfiltration, malware persistence, or compromise of internal systems beyond the web-facing defacement, and the article characterizes the event solely in terms of the visible website alterations. The available reporting does not indicate any long-term operational disruption to county services, nor does it describe law enforcement investigation outcomes, attribution actions beyond the attackers' self-identification, or subsequent security improvements.

Richland County is a small rural county in the U.S. state of Wisconsin with a population of approximately 18,021 according to the 2010 census, and its county seat is Richland Center. The breadth of the defacement across municipal, law enforcement, public health, recreational, and conservation sites suggests the attackers leveraged a shared hosting or server infrastructure that supported multiple county departments simultaneously. This single-point-of-compromise characteristic amplified the visible impact of the attack, turning one intrusion into a multi-site propaganda event. The episode illustrates how ideological hacking groups, even those operating with limited resources, can achieve outsized visibility by targeting shared infrastructure belonging to local government entities.

Sources

Sources available to members: 1 source.