Cyber Incident Victim: Al-Alam
Date:
Apr 2015
Location:
Iran
Summary
Pro-Saudi hackers compromised the social media accounts of Iran's state television, seizing control of its Twitter and YouTube platforms to disseminate fabricated reports about a Yemeni rebel leader's death and pro-Saudi propaganda, including praise for the Saudi monarchy. The victim attributed the breach to Saudi Arabia in retaliation for its critical reporting on the Saudi-led military campaign in Yemen, characterizing the incident as an act of psychological warfare aimed at disrupting its operations and spreading disinformation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 13, 2015, pro-Saudi hackers compromised the official Twitter account (@alalam_news) and YouTube channel of Iran’s state television network Al-Alam. The attack occurred on Sunday, with hackers posting fabricated reports about the death of Abdulmalik al-Huthi, leader of Yemen’s Shiite rebels, alongside messages endorsing Saudi Arabia’s military campaign in Yemen. A tweet from the hackers’ account (@Cyber__Emotion) explicitly dedicated the breach to Saudi pilots, warning Iran against criticizing Saudi Arabia. Simultaneously, the YouTube account featured uploaded videos containing pro-Saudi propaganda, including direct praise for King Salman. Both platforms disseminated anti-Iranian content throughout the intrusion period, with the compromised accounts remaining under attacker control at the time of initial media reporting.
Al-Alam attributed the breach to the Saudi government, labeling it a retaliatory act of “psychological warfare” motivated by the network’s critical coverage of Saudi airstrikes in Yemen. In an official website statement, the broadcaster asserted that its reporting on Saudi Arabia’s “aggression” in Yemen had provoked significant anger from Saudi authorities. The channel confirmed both social media accounts were temporarily disabled during the incident but did not disclose technical details of the compromise or specific recovery steps. No third-party cybersecurity firm involvement or forensic findings were referenced in available reporting. The hack’s operational impact centered on misinformation dissemination and reputational damage, with no mention of disrupted broadcasts or additional compromised systems beyond the social media platforms.