Cyber Incident Victim: State News Agency
Date:
Feb 2023
Location:
Bahrain
Summary
Hackers identifying as Al-Toufan disrupted Bahrain's State News Agency website alongside the country's international airport portal, causing intermittent outages and displaying gateway timeout errors during the incident. The group claimed the attack as a show of support for past anti-government protests, also defacing articles on a pro-government newspaper's website prior to targeting the agency. This followed previous cyber operations by the same actors against government sites during recent elections. The disruptions occurred amid historical tensions linked to suppressed unrest in the Gulf nation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 3 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 14, 2023, hackers identifying as Al-Toufan (Arabic for "The Flood") disrupted multiple Bahraini websites to coincide with the 12th anniversary of the country's Arab Spring protests. The group first targeted Akhbar Al Khaleej, a pro-government newspaper, altering articles on its website hours before the main attacks. By midday, they executed distributed denial-of-service (DDoS) attacks against Bahrain International Airport's official website, causing at least 30 minutes of downtime, and the state-run Bahrain News Agency (BNA) site, which experienced intermittent outages. Al-Toufan publicly claimed responsibility, posting screenshots of 504 Gateway Timeout errors from both sites as evidence of successful disruptions. The newspaper’s website remained completely offline throughout the day following the initial compromise. No data breaches or malware deployments were reported—the attacks focused exclusively on service availability and superficial content manipulation.
The incidents occurred on the anniversary of Bahrain’s 2011 uprising, with Al-Toufan explicitly stating the hacks supported "the revolution of our oppressed people." Historical context indicates this group previously targeted Bahraini government websites during November 2022 elections boycotted by Shiite opposition factions. The 2023 attacks mirrored prior tactics, exploiting symbolic dates to amplify political messaging through digital disruption. Authorities did not issue immediate statements regarding incident response, mitigation measures, or attribution beyond the hackers’ claims. Impacts were confined to temporary service unavailability for three entities: the airport’s public-facing site (affecting flight information access), the primary state news outlet (disrupting information dissemination), and the newspaper (rendered completely inaccessible post-compromise). No secondary infrastructure damage or collateral disruptions to airport operations or news agency operations were documented.