Richland County Recycling Committee

Summary

A pro-ISIS Algerian hacking group, Team System DZ, defaced multiple Richland County government domains, including Veterans Services, Emergency Management, and Recycling sites, replacing content with a message supporting the Islamic State and an Arabic audio track. The defacement featured a declaration of love for ISIS, calls for jihad, and claims about restoring Muslim dignity. The same group had previously targeted other entities like the University of Toronto and Isle of Wight, Virginia. While the compromised sites were restored promptly, it remains unclear whether sensitive data was accessed or how the attackers breached the county's systems.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 28, 2015, a pro-ISIS hacking group known as Team System DZ defaced three Richland County, Wisconsin government websites: the Veterans Services Office (veterans.co.richland.wi.us), Emergency Management (em.co.richland.wi.us), and Recycling Committee (recycling.co.richland.wi.us). The Algerian-based group replaced the sites' content with a defacement page displaying "Hacked By Team System Dz" at the top and played an Arabic-language audio song. The attackers embedded a written message supporting the Islamic State, referencing "#Op USA | Ir | il | Ru | Fr" and stating: "I love you Islamic State & Jihad Islamic State remain and expand, God willing, We will restore the dignity of Muslims Glory will return to Islam The dispute will return to outdated Be prepared." Evidence of the compromise was documented through Zone-h.org mirror links (IDs 25119668-25119670), preserving screenshots of the defaced pages. This marked the group's second known attack against Richland County, following their March 2015 breach of the Sheriff's Department website. Team System DZ had previously targeted the University of Toronto and Isle of Wight, Virginia with similar pro-ISIS content.

The defacements occurred before 9:00 PM Eastern Time on November 28, though the exact intrusion method remained undetermined. County administrators restored all affected websites prior to the publication of HackRead's report on November 28, with no public confirmation of whether attackers accessed sensitive data or backend systems. The incident occurred amid ongoing cyber conflicts between pro- and anti-ISIS factions, with Anonymous hackers reportedly targeting pro-ISIS websites earlier that same week. Richland County officials did not disclose technical details about the breach vector, remediation steps, or potential data exposure during the incident timeline covered in available reporting. No claims of data exfiltration or secondary attacks beyond website defacement were verified in the source material.

Sources

Sources available to members: 1 source.