Cyber Incident Victim: Google Malaysia
Date:
Apr 2015
Location:
Malaysia
Summary
A group of Bangladeshi hackers compromised multiple domains associated with a major technology company's Malaysian presence, including its search engine, image service, video platform, and a separate Malaysian web portal. The attackers defaced the sites with a message but provided no explicit motive, marking the second disruption to the company's Malaysian services within a short timeframe. The same threat actors previously targeted the organization's Kenyan domain. All affected services were restored following the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 3 actors | Available to members | Available to members |
Description
On April 15, 2015, three Bangladeshi hackers using the aliases Ne0-h4ck3r, TiGER-M@TE, and F0RTYS3V3N executed coordinated defacement attacks against multiple high-profile domains associated with Google and Yahoo in Malaysia. The targeted websites included Google Malaysia (ns2.google.com.my), Google Images Malaysia (images.google.com.my), YouTube Malaysia (youtube.my), and Yahoo Malaysia (yahoo.my). Attackers replaced legitimate content with a defacement page displaying the message "Pwnd by! Ne0-h4ck3r, TiGER-M@TE and F0RTYS3V3N | Mirror on the wall | #Hackers r0x Lamers Sux | How are you? | Here we are again!" alongside an email contact ([email protected]). This marked the second compromise of Google Malaysia within 24 hours, as TiGER-M@TE had previously disrupted the domain through DNS redirection earlier that day. Zone-h.org hosted mirrors validating all four defacements, with timestamps confirming simultaneous disruptions.
The incident represented a repeat pattern, as the same hacking collective had previously defaced Google Kenya in 2013 using similar methods. All affected domains were restored to operational status by the time Hackread.com published its report on the incident. No technical details regarding intrusion vectors were disclosed, though DNS manipulation played a role in the earlier Google Malaysia disruption. The defacement message contained no political motives or explicit demands beyond showcasing technical capability. Yahoo Malaysia's operational status remained ambiguous post-attack, as who.is records showed discrepancies between yahoo.my and malaysia.yahoo.com ownership despite automatic redirection. No user data breaches or service outages beyond the temporary defacements were documented in available reporting. Historical patterns suggested the attackers prioritized symbolic disruption of Google-associated country-code domains rather than persistent network access or data exfiltration.