Cyber Incident Victim: Mozambique
Date:
Feb 2022
Location:
Mozambique
Summary
A Mozambican government web portal hosting official sites was compromised in a cyberattack involving web defacement, prompting authorities to take the server offline temporarily and disrupting public access. Attackers replaced legitimate content with imagery associated with jihadist militants linked to the Islamic State, which has conducted prolonged violent insurgency operations in the country's northern Cabo Delgado region. The incident highlighted ongoing security challenges amid efforts by national and international forces to counter extremist activities in the area.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 21, 2022, Mozambique’s government portal hosting official websites experienced a cyberattack, prompting authorities to take the system offline for several hours. A senior government official responsible for electronic communications systems, Herminio Jasse, publicly confirmed the incident, describing it as a “web defacement type” attack. The attack compromised portals used to publish information for public consumption, though specific affected domains were not detailed. According to reports from the local private news outlet Carta de Mozambique, hackers replaced government webpages with images associated with jihadist groups. Jasse stated the government responded by immediately shutting down the targeted server to contain the breach, a move that disrupted public access to government information and generated user concerns during the outage. No data theft or further technical details about the attack vector were disclosed.
The incident occurred against the backdrop of prolonged insurgent violence in Mozambique’s northern Cabo Delgado province, where militants affiliated with the Islamic State have operated since 2017. These extremists, aiming to establish a caliphate, have caused over 3,700 deaths and displaced approximately 800,000 people. By mid-2021, Mozambique had deployed over 3,100 foreign troops from Rwanda and the Southern African Development Community to assist its military in counterinsurgency operations. The jihadist imagery displayed during the defacement aligned with the attackers’ apparent intent to reference this ongoing conflict. The government’s containment action focused solely on isolating the compromised server, with no mention of subsequent forensic analysis, attribution, or long-term remediation measures. The attack temporarily hindered information dissemination but did not disrupt broader government operations or critical infrastructure.