Cyber Incident Victim: RTFB
Date:
Oct 2016
Location:
Belgium
Summary
The Syrian Cyber Army claimed responsibility for DDoS attacks targeting multiple Belgian media outlets, including De Standaard, causing significant website downtime and performance degradation. The group alleged the attacks were retaliation for the outlets' failure to report Belgian military involvement in airstrikes near Aleppo, referencing an incident where two Belgian F-16s reportedly participated. One affected publication accused Russia of financing the attackers and identified Turkish servers as the attack infrastructure. Belgian authorities initiated an investigation, noting potential ties between the perpetrators and the Syrian Electronic Army.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 24, 2016, the Syrian Cyber Army (SCA) claimed responsibility for distributed denial-of-service (DDoS) attacks targeting multiple Belgian media organizations, including De Standaard, Het Nieuwsblad, Gazet van Antwerpen, Het Belang van Limburg, and RTFB. The attacks caused significant operational disruptions, with most targeted websites experiencing downtime and others becoming extremely slow to load. De Standaard and Het Nieuwsblad publicly acknowledged the cyberattacks affecting their online platforms. The SCA posted a statement on its homepage justifying the attacks by accusing Belgian media outlets of failing to report that two Belgian F-16 military jets participated in an October 18 airstrike near Aleppo. According to Russian military reports cited by the attackers, this strike destroyed two houses in Hassadjek, resulting in six fatalities and four injuries.
Belgian authorities initiated an investigation into the incident, with preliminary assessments suggesting SCA members maintained close ties to the Syrian Electronic Army. Het Nieuwsblad alleged Russian financial backing for the SCA and identified Turkey-based servers as the attack infrastructure. The attackers' public statement explicitly linked their actions to perceived omissions in Belgian media coverage of military operations in Syria. No technical details regarding attack vectors, mitigation measures, or duration of disruptions were disclosed by the affected organizations or investigators. The incident highlighted geopolitical motivations behind cyber operations against media entities and their role in information warfare contexts.