Cyber Incident Victim: Newsweek
Date:
Feb 2015
Location:
United States of America
Summary
Newsweek's Twitter account was compromised by a group identifying as 'CyberCaliphate,' which posted threats targeting the U.S. President and his family while referencing Islamic State and the Charlie Hebdo attack. The hackers claimed retaliation for U.S. military actions in Muslim-majority regions, asserted infiltration of national cybersecurity systems, and listed purported operatives under "brave mujahideen." This group had previously breached Pentagon social media assets, expressing support for Islamic State militants. The unauthorized content, including a threatening Valentine's Day message directed at the First Lady, was removed by the publication, though the breach duration remained unclear.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 10, 2015, the Twitter account of Newsweek magazine was compromised by hackers identifying themselves as 'CyberCaliphate.' The attackers posted multiple threatening messages directed at U.S. President Barack Obama and his family, accompanied by references to Islamic State (IS) and the slogan "Je suis IS"—a deliberate inversion of the "Je suis Charlie" solidarity phrase following the Charlie Hebdo attacks in Paris. One tweet explicitly threatened Michelle Obama with "#CyberCaliphate Bloody Valentine's Day #MichelleObama! We're watching you, you girls and your husband!" The hackers issued a broader political statement condemning U.S. military actions in Syria, Iraq, and Afghanistan, declaring, "While the US and its satellites are killing our brothers... we are destroying your national cybersecurity system from inside." The compromised account also displayed a list of names labeled "brave mujahideen" alongside the CyberCaliphate banner, signaling affiliation with or support for IS-linked extremism.
Newsweek regained control of its Twitter account by mid-morning on the same day, removing all unauthorized content, though the exact duration of the breach remained unspecified. The incident mirrored prior CyberCaliphate activity, including their January 2015 intrusion into the U.S. Central Command’s Twitter and YouTube accounts, where they similarly disseminated pro-IS propaganda. The group framed both breaches as retaliation against U.S. foreign policy and claimed capability to undermine national cybersecurity infrastructure. While no technical details of the hack were disclosed, the compromise temporarily disrupted Newsweek’s social media operations and amplified CyberCaliphate’s threats to a mainstream audience. The attackers leveraged Newsweek’s platform to broadcast intimidation tactics and ideological messaging, aligning with their pattern of targeting high-profile accounts to maximize visibility for their cause.