Cyber Incident Victim: Ministry of Planning
Date:
Oct 2015
Location:
Egypt
Summary
A hacktivist group affiliated with Anonymous targeted multiple Egyptian government websites, including the Ministry of Planning, in solidarity with protesters killed during earlier demonstrations. The attackers defaced the main pages of the presidency, tourism ministry, and other high-profile sites, causing temporary disruptions but reportedly causing no major system damage. The group, Anonymous Rabaa, claimed responsibility and posted proof of compromise alongside allegations of human rights abuses, while denying ties to banned Islamist movements. They framed the attacks as a response to state violence against protesters and warned of continued cyber operations against government entities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 24, 2015, the Egyptian branch of the hacktivist collective Anonymous launched coordinated cyberattacks against multiple Egyptian government websites, including the presidency, Cabinet Decision Support Center (IDSC), Ministry of Planning, Ministry of Tourism, Supreme Council of Press, and National Planning Institute. The attacks occurred on October 22, 2015, with the presidency website going offline after hackers compromised its main page. Cabinet spokesperson Hossam al-Qawish confirmed the intrusion but stated the hackers only defaced the homepage for a few minutes without penetrating core systems or exfiltrating data. Technical teams temporarily shut down the IDSC website as a containment measure. Attackers mirrored their defacements across additional high-profile targets, including the Egyptian information portal and Egyptian Observatory site. Zone-h archives and the group’s Facebook page hosted evidence of the compromises, including screenshots of altered webpages. Anonymous Rabaa, a subgroup identifying with Egypt’s 2013 Rabaa Square protests, publicly claimed responsibility.
The attackers cited retaliation for the 2013 Rabaa Square massacre, where security forces killed protesters demanding the reinstatement of ousted President Mohammed Mursi. In their manifesto, Anonymous Rabaa condemned human rights abuses and challenged the government’s crackdown on dissent, explicitly denying affiliation with the Muslim Brotherhood. They referenced prior operations, including an August 2014 defacement of Cairo Airport’s website marking the massacre’s anniversary. The group embedded a four-fingered Rabaa salute—a symbol of the protests—on compromised sites alongside messages declaring “The revolution continues.” Egyptian authorities restored services by taking affected websites offline for maintenance, with al-Qawish minimizing operational impacts by emphasizing the brevity of access and lack of systemic compromise. At the time of reporting, all targeted domains remained inaccessible, though no data destruction or secondary disruptions were documented.