Lashkar-e-Taiba

Summary

Indian hackers breached approximately 200 Pakistani websites, including the primary online platforms of Lashkar-e-Taiba, defacing them with messages condemning the group's leadership and accusing Pakistani military institutions of supporting terrorism. The attackers framed their actions as retaliation for a major terrorist attack, asserting national pride and calling for peace. In response, Pakistani hackers compromised the website of a major Indian financial institution, escalating the cyber conflict between the two nations. The incident disrupted the targeted websites and highlighted ongoing digital tensions linked to geopolitical hostilities.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 26, 2015, coinciding with the seventh anniversary of the 2008 Mumbai terrorist attacks, a group of Indian hackers conducted coordinated cyber intrusions targeting approximately 200 Pakistani websites. The attackers specifically compromised two primary online platforms associated with Lashkar-e-Taiba (LeT) - jamatdawa.org and jamatdawa.net - defacing them with anti-terrorism messages. An underground hacker using the alias Godzilla claimed responsibility for breaching the LeT sites, leaving a direct warning to Hafiz Mohammad Saeed, the group's founder: "Hafiz Mohammad Saeed, it's a promise from our side you will not stay in Pakistan for a longer time." The defacement included criticism of Pakistan's Inter-Services Intelligence agency and military, accompanied by Hindi poetry challenging Pakistan's stance on terrorism. The hackers emphasized their non-financial motives, stating the operation honored Indian security personnel killed during the 26/11 attacks while asserting national pride through signatures like "Proud to be a Muslim, Proud to be an Indian."

The cyber campaign triggered immediate retaliatory actions from Pakistani hackers, who successfully compromised the website of India's Central Bank of India by evening the same day. Security researchers confirmed both LeT websites remained offline following the defacements, disrupting the group's official online presence. No technical details regarding intrusion methods or data exfiltration were disclosed, though the hackers characterized their actions as symbolic retaliation for the 2008 attacks that killed 166 people. The incident demonstrated how historical geopolitical tensions could manifest in reciprocal website defacements between regional actors, with both sides leveraging anniversary dates for psychological impact. The Central Bank of India website restoration timeline was not specified in available reports.

Sources

Sources available to members: 1 source.