Cyber Incident Victim: Corelio
Date:
Oct 2016
Location:
Belgium
Summary
The Syrian Cyber Army claimed responsibility for DDoS attacks targeting multiple Belgian media outlets, causing significant downtime and degraded website performance. The group alleged the victims failed to report Belgian military involvement in airstrikes near Aleppo, which reportedly caused civilian casualties. One affected outlet accused Russia of financing the attackers and noted the operation utilized Turkish servers. Belgian authorities initiated an investigation into the incident and suggested potential links between the perpetrators and the Syrian Electronic Army group.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 24, 2016, the Syrian Cyber Army (SCA) executed distributed denial-of-service (DDoS) attacks against multiple Belgian media organizations, including Corelio-owned outlets De Standaard, Het Nieuwsblad, Gazet van Antwerpen, and Het Belang van Limburg, along with RTBF. The attacks caused significant disruption, with most targeted websites experiencing downtime while others suffered severe performance degradation, rendering them extremely slow to access. De Standaard and Het Nieuwsblad publicly acknowledged the cyberattacks on their digital platforms. The SCA claimed responsibility through a message posted on their official homepage, explicitly citing Belgian media's failure to report on the participation of two Belgian F-16 military jets in an October 18 airstrike near Aleppo as motivation. According to a Russian military report referenced by the attackers, this strike occurred around 03:00 AM in Hassadjek, destroying two houses, killing six people, and injuring four others.
The operational impacts included extended service interruptions affecting news dissemination capabilities during the attack window. Het Nieuwsblad attributed the attacks to servers located in Turkey and accused the Russian government of financially supporting the SCA. Belgian law enforcement agencies initiated a formal investigation into the incident, with authorities asserting operational links between the SCA and the more established Syrian Electronic Army group based on tactical similarities and infrastructure patterns. No data breach or system compromise beyond the temporary DDoS disruption was reported by the affected media organizations. The attackers did not issue additional threats or demands beyond their initial public statement justifying the attacks as retaliation for perceived omissions in conflict coverage.