Richland County Land Conservation Department

Summary

Pro-ISIS hackers affiliated with the Moroccan group Team System DZ compromised multiple Richland County, Wisconsin government websites, including the Land Conservation Department, Sheriff's Office, municipal sites, and public service portals. The attackers defaced the sites with messages expressing support for ISIS, anti-US and anti-Israel rhetoric, and jihadist ideology. All affected websites were subsequently restored following the breach. This incident aligns with a broader pattern of pro-ISIS cyberattacks targeting US government entities during that period.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 21, 2015, pro-ISIS hackers operating under the name Team System DZ breached multiple websites belonging to Richland County, Wisconsin. The attackers compromised servers hosting high-profile county government sites, including the Richland County Sheriff’s Department, the City of Richland Center Municipality, the Parks Commission, the Ambulance Service, the Richland County Fair & Recycling department, the Land Conservation Department, and the Richland County Fitness Center. The hackers replaced the legitimate content of these websites with a defacement page displaying a political message. The coordinated attack simultaneously affected these seven distinct county-operated domains, indicating a broad compromise of county web infrastructure. No specific technical details regarding the intrusion method or initial attack vector were disclosed in available reports.

The defacement page featured the statement: “Hacked by Team System Dz! I am a Muslim & I love jihad, I love ISIS | Fuck Israel & USA.” Team System DZ, identified as Morocco-based actors, explicitly aligned their actions with support for ISIS and hostility toward the United States and Israel. Zone-h, a platform documenting website defacements, archived mirrors of the compromised sites as evidence. This incident followed a pattern of pro-ISIS cyber activity targeting U.S. government entities, including prior leaks of military personnel data and attacks on municipal websites like the Isle of Wight, Virginia, in January 2015. County authorities restored all affected websites to normal operation by the time the incident was publicly reported. No data theft, service disruption beyond the defacements, or secondary malware deployment was documented in relation to this event.

Sources

Sources available to members: 1 source.