Cyber Incident Victim: Al Ittihad
Date:
Feb 2015
Location:
United Arab Emirates
Summary
The UAE's oldest Arabic newspaper experienced a website defacement by ISIS-affiliated hackers, who replaced its content with their logo, a black flag, Arabic text, and imagery of armed militants. Attackers reportedly uploaded a photograph of a prominent UAE female pilot involved in anti-ISIS operations and issued threats against the region, though editorial staff confirmed no data exfiltration occurred. The incident coincided with renewed regional military actions against the extremist group. The publication restored its website functionality following the breach. This marked another cybersecurity incident against the media outlet, which had previously been targeted by other hacker collectives.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 14, 2015, ISIS-affiliated hackers compromised the website of Al Ittihad, the United Arab Emirates' oldest Arabic-language newspaper, during a period of heightened regional tensions. The attackers replaced the newspaper's homepage with propaganda imagery featuring a black flag bearing Arabic text and a photograph of three armed militants in military attire. They additionally displayed an image of Major Mariam al Mansouri, the UAE's first female fighter pilot, who had participated in coalition airstrikes against ISIS targets. The defacement occurred as the UAE renewed its military operations against ISIS following the group's execution of a Jordanian pilot. Abu Dhabi-based editor-in-chief Mohammed Al Hammadi confirmed the website's defacement but clarified that no data exfiltration occurred from the newspaper's servers. The hackers' primary actions involved visual vandalism and dissemination of threatening messages directed at regional populations. Technical details regarding the attack vector or duration of unauthorized access were not disclosed in available reports.
This incident marked another security breach for Al Ittihad's digital infrastructure, which had previously suffered compromises by the pro-Assad Syrian Electronic Army and an individual using the alias "Twister." The newspaper's technical team restored normal website operations by the time external media reported the incident, though no specific containment measures or forensic procedures were detailed publicly. The attack's timing aligned strategically with both Valentine's Day observances and intensified military confrontations between UAE forces and ISIS militants. No operational disruptions to the newspaper's print publications or long-term service outages were documented in relation to the hack. Historical patterns indicated the website remained a recurring target for ideologically motivated cyber operations due to the publication's regional prominence and governmental affiliations.