Cyber Incident Victim: RTSH
Date:
Oct 2014
Location:
Albania
Summary
The Albanian state television's website was defaced by a group identifying as "Serbian Hackers," who replaced its content with a burning Albanian flag and a map of Kosovo accompanied by the message "Kosovo is the heart of Serbia." This cyberattack was a direct response to geopolitical tensions stemming from a disrupted soccer match between Serbia and Albania, during which a drone displaying a Greater Albania flag incited violence. The defacement rendered the victim's site inaccessible for hours, displaying an "under construction" notice after initial disruption. The incident reflects broader ongoing cyber hostilities between Serbian and Albanian actors, characterized by retaliatory website defacements with nationalist messaging, often tied to territorial disputes over Kosovo.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On September 15, 2018, Serbian hackers defaced the official website of Radio Television of Albania (RTSH), Albania's state television broadcaster. The attackers replaced the site's regular content with an image depicting Albania's national flag in flames alongside an embedded map of Kosovo bearing the English-language message "Kosovo is the heart of Serbia." This defacement rendered RTSH's website inaccessible to regular users for multiple hours, during which visitors encountered only the hackers' modified content. After several hours, administrators temporarily replaced the defaced page with an "under construction" notice and removed the inflammatory imagery. The hacking group claimed responsibility under the name "Serbian Hackers," explicitly framing their actions as retaliation for an October 14, 2014 soccer match incident between the Albanian and Serbian national teams in Belgrade. During that match, a drone displaying a "Greater Albania" flag flew over Partizan Stadium, leading Serbian player Stefan Mitrović to grab the flag, which triggered violent clashes between players and pitch invasions by Serbian fans. The match was ultimately abandoned amid widespread disorder.
The cyberattack intensified existing diplomatic tensions stemming from the drone incident. Serbian Interior Minister Nebojša Stefanović cited the drone provocation as evidence that Albania lacked maturity for European integration, while Albanian Prime Minister Edi Rama expressed disappointment in Serbian officials' responses via Twitter, denying any Albanian governmental involvement in Greater Albania territorial ambitions. Serbian authorities accused Olsi Rama, the Prime Minister's brother, of operating the drone after reportedly detaining him with a remote control in the stadium's VIP section—an allegation he denied. This incident reflected broader patterns of cyber hostilities between Serbian and Albanian actors, with frequent defacements targeting governmental, municipal, religious, and media websites in both nations. Attacks typically featured nationalist rhetoric related to Kosovo's status and occurred around significant events or holidays, executed by regionally affiliated hacker groups rather than international collectives like Anonymous. The RTSH defacement specifically disrupted public access to critical information channels and necessitated extended remediation efforts, while amplifying bilateral tensions through its symbolic attack on national symbols and territorial claims.