French Ministry of Defense

Summary

The Anonghost hacking group, associated with the Anti-#CharlieHebdo operation, defaced three websites belonging to French government entities including the Ministry of Defense by exploiting outdated content management systems. The attackers modified site content but did not extract sensitive data, prompting rapid intervention from national cybersecurity agencies to shut down the affected platforms.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 21, 2015, the hacker group Anonghost resurfaced with a cyberattack targeting French government infrastructure. At approximately 21:00 that evening, the group's leader Mauritania Hacker contacted ZATAZ journalists to announce an ongoing operation against the Ministry of the Interior and Ministry of Defense. This action followed Anonghost's previous campaign dubbed "Operation Anti #CharlieHebdo," during which they had collaborated with approximately thirty other cyberactivist groups to compromise thousands of websites through methods including backdoor installations, defacements, database thefts, and DDoS attacks. The attackers specifically compromised three government web properties: sgcipd.interieur.gouv.fr, prevention-delinquance.interieur.gouv.fr, and ensoa.terre.defense.gouv.fr – the latter being an informational portal for the French Army's National Active Non-Commissioned Officers School. Forensic evidence indicated the attackers modified website content, as documented through screen captures obtained by journalists. Anonghost claimed autonomous control over the operation's duration, stating their group alone would decide when to terminate activities.

The compromised systems showed no evidence of sensitive data exfiltration, with investigators attributing the breach to unpatched content management system (CMS) vulnerabilities. France's National Cybersecurity Agency (ANSSI) coordinated with the Ministry of Defense to implement containment measures, resulting in the prompt takedown of all affected websites. Technical analysis suggested the attackers exploited outdated CMS software to execute defacements rather than penetrating deeper network infrastructure. The incident highlighted ongoing tensions following the Charlie Hebdo attacks, with Anonghost's coalition including diverse actors ranging from Muslim youth expressing concerns about Islamophobia to extremist elements. Government cybersecurity teams maintained operational continuity for critical systems while restoring the compromised public-facing sites.

Sources

Sources available to members: 1 source.