Armaments Corporation of South Africa

Summary

A South African defense procurement agency was compromised by Anonymous hacktivists through an SQL injection attack, resulting in the leak of transaction records involving major aerospace and defense contractors. The attackers exfiltrated HTML files containing invoice numbers, order details, and financial amounts, while also gaining access to supplier credentials stored in plaintext that permitted system logins. Vulnerabilities in the agency's settlement system allowed unauthorized access without passwords, though no email credentials were exposed in the published data. This breach occurred as part of a broader campaign targeting defense sector entities.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 11, 2016, the Armaments Corporation of South Africa (Armscor), the official arms procurement agency for the South African Department of Defence, suffered a data breach attributed to a hacktivist operating under the Anonymous collective. The attack occurred as part of Operation OpAfrica, a campaign that previously targeted Israeli arms importers during Operation OpIsrael. The attacker exploited a vulnerability identified as a simple SQL injection to infiltrate Armscor’s systems, gaining unauthorized access to sensitive supplier data. This included 19,938 supplier IDs, names, and associated plaintext passwords stored within the agency’s Settlement System. The compromised credentials enabled unauthorized logins to the system either as suppliers or managers. Additionally, the attacker identified a critical flaw allowing access to settlement records using only supplier IDs without requiring password authentication, further exposing systemic security weaknesses.

The attacker exfiltrated 63 MB of data comprising 104 HTML files, which were subsequently leaked on the dark net. The leaked records contained transactional details such as invoice numbers, order numbers, and invoice amounts involving high-profile defense and aeronautics contractors including Airbus, Thales Group, Rolls Royce, EADS (European Aeronautic Defence and Space Company), and Denel. While the leaked data did not include email addresses or passwords beyond those tied to supplier accounts, the exposure of financial and procurement details posed significant risks to the affected companies’ operational security and contractual confidentiality. The breach highlighted vulnerabilities in Armscor’s web infrastructure, particularly inadequate safeguards against SQL injection attacks and flawed authentication mechanisms for critical supplier portals. No public statements from Armscor regarding containment measures or system remediation were documented in the immediate aftermath of the disclosure.

Sources

Sources available to members: 1 source.