Cloudmark is now part of Proofpoint. Learn More

About Proofpoint

Syrian Hackers Promote Assad Government by Vandalising Random Web Sites

The Syrian Electronic Army (SEA) has been getting a lot of press recently for successful phishing attacks against media outlets that they feel have painted an unfair picture of the Syrian government. In investigating hacked web servers used by spammers we’ve come across another, smaller, group supporting the Syrian Government. The SeCuR!TY LiONS HaCK3RS (sic) are not hacking into other peoples’ web servers to send spam though. They are just doing it to deface the site with a pro-Assad message.

Here’s the file uploader they install:
Secur!ty Lions
Note the PHP begins with GIF89a1 indicating that this malware was uploaded as an image file and then renamed.

Here’s one of their defaced web sites:
Secur!ty Lions hacked web site
This page even contains contact information for the members of the hacking team and a link to their Facebook page! The Facebook link shown above ( is no longer active, but they can currently be found on
Secur!ty Lions Facebook Page
The page contains notices of web sites they have hacked, and lists of hacked email accounts with passwords.

They also have an Android App. Doesn’t everyone?

At least the SeCuR!TY LiONS are safely out of reach of US law enforcement for the time being. Here’s a web site defaced by another Arab nationalist, R3d ErRor (sic):
R3d Error

Mister ErRor kindly keeps a list of the web sites he has defaced at He is currently up to 1,385, though not all of them involve flag burning. (Quick quiz: How many mistakes can you spot in that attempt at a US flag, apart from the fact that it is on fire?)

In a 2012 profile on a hacker web site R3d ErRor wrote:
R3d Error profile
If he really is in Washington, then I’m sure the NSA has his number. After all, the NSA has everybody’s number.

One thought on “Syrian Hackers Promote Assad Government by Vandalising Random Web Sites”

Leave a Reply

Your email address will not be published. Required fields are marked

Learn More About Cloudmark
Our Products
News and Events
Site Map  •  Privacy Policy  •  ©2002–2020 Cloudmark, Inc.