Richland County Recycling Committee

Summary

A pro-ISIS hacking group from Morocco known as Team System DZ compromised multiple Richland County government websites, including the Recycling Committee, through defacement attacks displaying messages endorsing ISIS and expressing hostility toward the US and Israel. The incident impacted several county departments and services, with all affected sites subsequently restored following the breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 21, 2015, pro-ISIS hackers operating under the name Team System DZ, identified as a Moroccan group, breached multiple websites belonging to Richland County, Wisconsin. The attackers compromised high-profile county-operated domains, including the Richland County Sheriff’s Department, City of Richland Center Municipality, Parks Commission, Ambulance Service, Recycling Committee, Land Conservation Department, Richland County Fair, and Richland County Fitness Center. Each defaced site displayed a uniform message stating, "Hacked by Team System Dz! I am a Muslim & I love jihad, I love ISIS | Fuck Israel & USA," accompanied by visual defacement. The hackers publicly documented their actions through Zone-h mirror links, providing evidence of the breaches. This incident disrupted public access to critical county services and informational platforms, though the duration of the outages was not specified. The attack aligned with a broader pattern of pro-ISIS cyber activities targeting U.S. government entities in early 2015.

The defacement occurred amid a series of similar incidents attributed to ISIS-affiliated groups, including the January 2015 breach of the Isle of Wight, Virginia’s website and the February 2015 compromise of Newsweek’s Twitter account. Team System DZ’s actions mirrored prior tactics, such as leaking U.S. military personnel data to incite violence against them. Richland County authorities restored all affected websites by the time the reporting article was published, though specific remediation steps or forensic investigations were not detailed. No data theft or secondary malware deployment was mentioned in the source material. The incident highlighted vulnerabilities in local government digital infrastructure but resulted in no reported physical or financial damages beyond temporary service interruptions and reputational harm. Operational continuity was reestablished following the restoration of the compromised sites.

Sources

Sources available to members: 1 source.