Cyber Incident Victim: Davos in the Desert
Date:
Oct 2018
Location:
Saudi Arabia
Summary
The website for a high-profile Saudi investment conference was hacked and defaced with anti-government messages condemning the killing of journalist Jamal Khashoggi and civilian casualties in Yemen, accompanied by a digitally altered image depicting the Crown Prince in a violent act. The defacement demanded international accountability for Saudi leadership's alleged human rights violations. The compromised site was swiftly taken offline. This incident occurred amid global backlash over Khashoggi's death at a Saudi consulate, which sparked accusations of state-sponsored murder against the Crown Prince. Concurrently, a dismissed senior aide linked to the Khashoggi case reportedly resumed leadership of Saudi Arabia's cybersecurity federation, though his connection to the hack remains unspecified.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 22, 2018, the official website for Saudi Arabia's "Davos in the Desert" investment conference was compromised by hackers who defaced it with politically charged content. The attackers replaced the site's original material with anti-Saudi government messages condemning the killing of journalist Jamal Khashoggi, who had died earlier that month inside the Saudi consulate in Istanbul. A digitally altered image depicted Crown Prince Mohammed bin Salman (MBS) preparing to execute Khashoggi, accompanied by text demanding international accountability for Saudi Arabia's alleged "barbaric and inhuman actions." Specific accusations referenced both Khashoggi's death and Saudi military operations in Yemen. The defacement remained visible for only minutes before the website was taken offline entirely, according to Washington Post reporting. This incident occurred during heightened global scrutiny of Saudi leadership following Khashoggi's disappearance on October 2 and subsequent conflicting official explanations about his fate.
The hack directly exploited international outrage over Khashoggi's killing, which multiple governments and intelligence agencies attributed to orders from Saudi leadership despite official denials. Saudi authorities maintained Khashoggi's death resulted from an unauthorized operation, not state policy. In response to the broader scandal, Crown Prince Mohammed bin Salman dismissed senior aide Saud al-Qahtani, who was implicated in monitoring Khashoggi's interrogation via Skype. However, al-Qahtani reportedly resumed his position as chairman of the Saudi Federation for Cybersecurity, Programming and Drones shortly afterward. The conference website defacement caused no prolonged technical disruption due to its rapid removal but amplified existing diplomatic tensions surrounding Saudi Arabia's human rights record. No hacking group claimed responsibility, and the Saudi government did not publicly disclose forensic findings about the attack's origin or methodology.