State Ministry for Euro-Atlantic Integration of Georgia

Summary

Pro-ISIS hackers compromised the website of Georgia's State Ministry for Euro-Atlantic Integration, which supported NATO-related activities and EU-funded initiatives. The attackers defaced the site with their logo and a message promoting their ideology, temporarily disrupting its operations. The same group also targeted multiple Italian government websites, including research and engineering platforms. While the ministry's site was restored promptly, this incident followed a pattern of high-profile cyberattacks attributed to pro-ISIS actors, some of which were later suspected to involve state-sponsored groups. The attack highlighted ongoing threats to government digital infrastructure linked to geopolitical alliances.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 8, 2015, the official website of Georgia's State Ministry for Euro-Atlantic Integration (www.eu-nato.gov.ge), which handled NATO integration activities with European Union funding, was compromised by hackers affiliated with the Islamic State (IS). The attackers replaced the site's content with a defacement page displaying the ISIS logo and a message proclaiming "Hacked by Cyber Islamic State! Khilafah will transform the world." Evidence of the breach was documented through a Zone-H mirror (ID 24559786) and a preserved Google Cache snapshot. The same hacking group simultaneously targeted multiple Italian government and research websites, including the AIRO 2015 robotics workshop platform and the National Research Council's Engineering Department site, leaving similar defacements. These coordinated attacks demonstrated the group's broader targeting of European-associated entities.

The compromised Georgian ministry website was restored to operational status shortly after the incident was reported. This defacement occurred amid a series of high-profile cyber operations attributed to pro-ISIS actors earlier in 2015, including the April takeover of French broadcaster TV5Monde's networks and BBC transmissions. While investigations into those prior incidents suggested potential Russian state-linked involvement by groups like APT28, no such attribution claims were documented for the Georgian ministry breach. The incident underscored persistent threats to government digital assets aligned with Euro-Atlantic partnerships, though no specific operational disruptions or data theft beyond the defacement were disclosed. Restoration efforts focused on removing unauthorized content without publicized technical countermeasures or long-term downtime.

Sources

Sources available to members: 1 source.