Cyber Incident Victim: Center for Information and Decision Support
Date:
Oct 2015
Location:
Egypt
Summary
Anonymous hackers targeted multiple Egyptian government websites, including the presidency and the Center for Information and Decision Support, temporarily disrupting services by defacing main pages and forcing temporary shutdowns. The attacks, claimed by the group Anonymous Rabaa in solidarity with protesters killed during past crackdowns, involved posting protest messages, screenshots of alleged human rights abuses, and proof of compromise on third-party platforms. While officials stated no major systems or data were breached, several sites experienced downtime. The hackers denied affiliation with banned Islamist groups but framed their actions as defending victims of state violence, particularly referencing the Rabaa square massacre and ongoing political repression.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On October 24, 2015, the Egyptian branch of the hacktivist collective Anonymous launched coordinated cyberattacks against multiple Egyptian government websites, including the Center for Information and Decision Support (IDSC). The attacks occurred on Thursday, October 22, with the Egyptian presidency website going offline due to hacking activity confirmed by Cabinet spokesperson Hossam al-Qawish. Technical assessments indicated hackers compromised only the main page of the presidency site for a few minutes without penetrating core systems or exfiltrating sensitive data. Parallel attacks targeted the Cabinet Decision Support Center (IDSC), forcing its temporary shutdown by government technical teams. Additional impacted entities included the Ministry of Tourism, Ministry of Planning, Supreme Council of Press, Egyptian Information Portal, Egyptian Observatory site, National Planning Institute, and other high-profile government domains. Attackers provided proof of compromise through Zone-h archives and their official Facebook page, listing all targeted websites and mirror links.
Anonymous Rabaa claimed responsibility for the attacks, framing them as retaliation for security forces killing protesters during the 2013 Rabaa Square massacre and other human rights violations. The group disseminated screenshots and video evidence of alleged abuses alongside defacement messages featuring the four-fingered Rabaa salute and the statement "The revolution continues." They explicitly denied affiliation with Egypt's banned Muslim Brotherhood while demanding accountability for deaths during the 2011 revolution, 2013 Rabaa clashes, and Sinai insurgency. Government response involved public reassurances from spokesperson al-Qawish, who minimized operational impacts by emphasizing the superficial nature of the breaches. Technical containment measures included voluntary takedowns of compromised sites like the IDSC portal. At the time of reporting, all targeted websites remained offline, including the presidency domain (presidency.gov.eg), though no data destruction or persistent access was confirmed. The incident followed a similar August 2015 attack on Cairo Airport's website commemorating the Rabaa massacre's first anniversary.