Combat 18 Canada

Summary

A Canadian neo-Nazi group's official website was compromised via a basic SQL injection attack, resulting in the theft and public release of member and administrative credentials. The attacker, operating under the alias @SQLiNairb, exfiltrated databases containing over 1,300 user accounts with email addresses, passwords, and administrative login details, subsequently leaking partial data on Pastebin and a full dataset through MirrorCreator. The breach exposed five databases, including member registrations and WordPress installations, accompanied by a taunting message condemning the group's ideology. The incident rendered the organization's sensitive internal authentication systems publicly accessible, compromising both operational security and member anonymity.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 13, 2014, a hacker operating under the alias @SQLiNairb publicly disclosed a breach of the National-Socialist Party of Canada's official website (https://nspcanada.nfshost.com/), a group widely identified as a neo-Nazi organization. The attacker exploited a basic GET-based MySQL injection vulnerability to extract multiple databases containing user credentials and administrative information. Initial disclosure occurred through a partial data dump uploaded to Pastebin, accompanied by a message stating "Racists, fascists, and hate-mongers beware, nairb is here ;)", explicitly framing the attack as targeting extremist groups. The compromised systems included five distinct databases: nspcanada, wordpress, wordpress2, mysql, and db_meinkampf_en, indicating broad access across the website's infrastructure. Forensic analysis of the breach revealed exposure of 1,356 user accounts containing email addresses, alongside administrative credentials with encrypted passwords and non-email associated login details.

The full data dump, released shortly after the initial Pastebin leak, was distributed via MirrorCreator, expanding the dissemination of sensitive materials. Exfiltrated records included plaintext passwords, email addresses, and usernames belonging to members and administrators of the organization. While the website primarily hosted ideological content described as "nothing important" in operational value, the comprehensive credential exposure created significant security risks for individuals affiliated with the group. No remediation efforts or public responses from the National-Socialist Party of Canada were documented in the available incident reporting. The attacker's methodology emphasized the exploitation of fundamental web application vulnerabilities to compromise systems associated with extremist activities, resulting in the wholesale disclosure of member identities and authentication data.

Sources

Sources available to members: 1 source.