Cyber Incident Victim: Slobodna Dalmacija
Date:
Mar 2022
Location:
Croatia
Summary
A pro-Russian hacking group targeted the website of Croatian newspaper Slobodna Dalmacija, defacing its online portal with articles containing Russian propaganda about the Ukraine war. The attackers compromised the publication's digital platform to display unauthorized content promoting Russian narratives regarding the conflict. Local authorities launched a criminal investigation into the cyber intrusion following reports of the incident, which disrupted the media outlet's normal operations and temporarily replaced legitimate news content with war-related disinformation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 22, 2022, the Croatian daily newspaper Slobodna Dalmacija experienced a cyberattack targeting its online presence. Pro-Russian hackers compromised the Split-based publication’s website, replacing legitimate content with articles disseminating Russian propaganda narratives related to the ongoing war in Ukraine. The defacement resulted in visitors encountering these unauthorized materials prominently displayed on the news portal. The attack disrupted the outlet’s normal digital operations, temporarily preventing access to authentic news reporting. No technical details regarding the intrusion vector, such as exploitation methods or compromised infrastructure components, were disclosed in initial reports. The incident represented a direct compromise of the newspaper’s primary digital communication channel during an active conflict period characterized by heightened cyber hostilities.
Croatian law enforcement authorities promptly initiated an investigation into the breach following its detection, as confirmed by reports from the national news agency HINA. The attack’s primary observable impact centered on the unauthorized content substitution rather than prolonged service outages or data exfiltration claims. While operational restoration timelines weren’t specified, the defacement’s public nature caused immediate reputational and operational consequences for the media organization. The propaganda materials specifically focused on war-related narratives aligned with Kremlin interests, indicating a politically motivated attack timed to influence regional perceptions of the Ukraine conflict. No attribution to specific threat actors or groups was formally provided by investigators at the time of initial reporting. The incident underscored vulnerabilities in media infrastructure during geopolitical crises while demonstrating the tactical use of website compromises for information warfare objectives.