Cyber Incident Victim: Anonymous R4BIA Team
Date:
Oct 2015
Location:
Egypt
Summary
A hacktivist group operating as Anonymous R4BIA Team conducted cyberattacks against multiple Egyptian government entities, including the presidency website, ministries, and information portals, causing temporary disruptions and defacements. The attackers displayed protest messages referencing human rights abuses and solidarity with victims of past violent crackdowns, particularly those killed during demonstrations at Rabaa square. They denied affiliation with banned Islamist movements but declared themselves defenders of protesters' rights. The group provided evidence of compromised sites through defaced pages featuring the four-fingered Rabaa symbol and posted screenshots alongside statements condemning political divisions. While officials claimed only superficial breaches affecting public-facing pages, the incidents highlighted ongoing tensions between authorities and opposition factions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On October 22, 2015, the Egyptian presidency website experienced a cyber attack that forced it offline. Cabinet spokesperson Hossam al-Qawish confirmed the incident was a hacking attempt by an Anonymous-affiliated group, though he emphasized no major systems were compromised beyond temporary disruption. The attackers defaced the main page of the presidency website for several minutes before it was taken down by technical teams. Simultaneously, the Cabinet Decision Support Center (IDSC) website was targeted and preemptively shut down by administrators. Additional government portals compromised included the Ministry of Tourism, Ministry of Planning, Supreme Council of Press, Center for Information and Decision Support, Egyptian Information Portal, Egyptian Observatory site, and National Planning Institute. The hackers provided evidence of these breaches through Zone-H archives and their official Facebook page, listing all targeted domains and mirror links. Technical staff responded by taking affected systems offline for investigation and restoration.
Anonymous R4BIA Team claimed responsibility for the coordinated attacks, framing them as retaliation for the 2013 Rabaa Square massacre where security forces killed protesters demanding former President Mohammed Mursi's reinstatement. The group explicitly denied ties to Egypt’s banned Muslim Brotherhood but declared solidarity with victims of state violence, referencing deaths during the 2011 revolution, 2013 Rabaa clashes, and Sinai insurgency. They published screenshots and videos documenting alleged human rights abuses alongside proof of the website intrusions. This incident followed their August 2014 defacement of Cairo Airport’s website, which displayed a four-fingered Rabaa salute on the massacre’s anniversary. The attacks coincided with government crackdowns on Islamist opposition groups, including Mursi’s imprisonment. All compromised websites remained offline at the time of reporting, though authorities asserted no sensitive data or critical infrastructure was breached. The hackers vowed continued operations until human rights grievances were addressed.