Cyber Incident Victim: Syrian Observatory for Human Rights
Date:
Jul 2015
Location:
United Kingdom
Summary
Supporters of the Islamic State hacked a Syrian human rights watchdog's website, posting a manipulated image depicting its director as a hostage in an orange jumpsuit alongside an armed militant, accompanied by threatening messages in English and Arabic. The attackers, identifying as "The Cyber Army of the Khilafah," prompted the group to take its site offline, marking an escalation from previous threats received via letters and emails. The targeted director described the cyberattack as unprecedented in severity, emphasizing its intent to intimidate their documentation of wartime abuses. The incident followed Islamic State's release of a video allegedly showing the execution of two Syrian activists accused of espionage, underscoring the militant group's broader campaign of violence against perceived opponents.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On July 8, 2015, supporters of the Islamic State group hacked the website of the Syrian Observatory for Human Rights, a UK-based organization documenting human rights violations in Syria’s conflict. The attackers, identifying as "The Cyber Army of the Khilafah," defaced the website with threatening imagery and messages targeting the Observatory’s director, Rami Abdulrahman. They superimposed Abdulrahman’s face onto a hostage depicted in an orange jumpsuit kneeling beside an Islamic State militant holding a knife—a direct reference to the group’s execution videos of captives in similar attire. The hackers posted bilingual messages in English and Arabic containing derogatory language and threats against the watchdog group. The Observatory promptly took its website offline to contain the breach. Abdulrahman confirmed the attack via telephone, stating the group had never faced such a sophisticated cyber threat despite receiving prior death threats through letters, emails, and social media from Syrian government loyalists and jihadist sympathizers. He characterized the incident as a "serious message" intended to halt their documentation of wartime abuses.
The cyberattack occurred two days after Islamic State released a video showing the execution of two Syrian activists in Raqqa, who were also dressed in orange jumpsuits and accused of espionage. The Observatory’s website remained inaccessible following the takedown, disrupting its role as a primary source of conflict-related information gathered through ground sources. Abdulrahman emphasized the unprecedented scale of the attack compared to previous harassment campaigns, noting its psychological impact and explicit intent to intimidate. The incident underscored the risks faced by human rights monitors operating in digitally exposed environments amid active conflict zones. No technical details about the attack vector or data compromise were disclosed, and the Observatory did not specify a timeline for restoring its online presence at the time of reporting.