Cyber Incident Victim: Maestro
Date:
Oct 2019
Location:
Georgia
Summary
A massive cyber attack targeted multiple entities in Georgia, including TV broadcasters such as Maestro and a major web hosting provider, resulting in the temporary disruption of two television stations and the defacement of approximately 15,000 websites. The attackers replaced homepages with images of a former president and a banner stating "I'll be back," impacting government sites, courts, and the president's official page, though critical national infrastructure remained unaffected. While the scale and nature of the targets led experts to suggest potential state sponsorship and geopolitical motives, attribution remained unconfirmed as investigations were ongoing. The incident highlighted vulnerabilities in digital infrastructure and echoed prior attacks linked to foreign actors.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 28, 2019, a coordinated cyber attack disrupted multiple entities in Georgia, including media outlets, government institutions, and private organizations. The incident began with the defacement of approximately 15,000 websites hosted by Proservice, a Georgian web hosting provider. Attackers replaced homepage content with an image of former President Mikheil Saakashvili—a figure wanted on criminal charges in Georgia—accompanied by the message "I'll be back." Among the affected sites were those belonging to the Georgian President's office, general jurisdiction courts, local newspapers, businesses, and personal websites. Two television broadcasters, Imedi TV and Maestro, were temporarily forced offline during the attack. Critical national infrastructure systems remained unaffected. The scale of the disruption prompted Proservice to publicly acknowledge the incident, describing it as "one of the largest cyber-attacks on the cyber space of Georgia."
Proservice initiated restoration efforts immediately upon detecting the attack, collaborating with Georgia's Ministry of Internal Affairs and cybersecurity experts. By 8:00 pm local time on October 28, the company reported restoring over 50% of the affected websites. Georgia's interior ministry launched an investigation into the incident but had not publicly attributed responsibility at the time of reporting. Cybersecurity experts cited in media analyses noted the attack's geopolitical implications, with some suggesting the scale and target selection indicated potential state sponsorship. Parallels were drawn to the 2008 cyber attacks against Georgia, which independent analyses later linked to Russian military intelligence units. The incident highlighted concerns about politically motivated cyber operations targeting media and government entities, though no definitive evidence connected it to any specific nation-state or group. Service restoration for remaining affected systems continued beyond the initial response period.