Website defacement is an attack on a website that changes the visual appearance of the site or a webpage.

These are typically the work of defacers, who break into a web server and replace the hosted website with one of their own. Defacement is generally meant as a kind of electronic graffiti and, as other forms of vandalism, is also used to spread messages by politically motivated cyber protesters or hacktivists.

Malware/Threat actors

Name	Type	Years	Source
Operation Cleaver	threat actor	2012-2013	Cylance_Operation_Cleaver_Report.pdf stamp.jsp?tp=&arnumber=7460498&tag=1
Syrian Electronic Army	threat actor	2012	fireeye-wwc-report.pdf KL_report_syrian_malware.pdf
Whois Hacking Team	threat actor	2009-2013	dissecting-operation-troy.pdf HPSR%20SecurityBriefing_Episode16_NorthKorea.pdf
Ajax Security Team	threat actor	2010-2013	rpt-operation-saffron-rose.pdf fireeye-operation-saffron-rose.pdf Threat%20Group%20Cards.pdf
Flying Kitten	threat actor	2013-2014	GlobalThreatIntelReport.pdf Threat%20Group%20Cards.pdf CrowdStrike_Flying_Kitten.pdf
Gh0st Rat	malware	2009-2012	Know%20Your%20Digital%20Enemy.pdf
Charming Kitten	threat actor	2014	GlobalThreatIntelReport.pdf Charming_Kitten_2017.pdf
APT28	threat actor	2008-2016	APT28-Center-of-Storm-2017.pdf CYBERWAR-fd_2_.pdf JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf journey-zebrocy-land threat-group-4127-targets-hillary-clinton-presidential-campaign stamp.jsp?tp=&arnumber=7460498&tag=1
Lazarus Group	threat actor	2011-2014	Operation-Blockbuster-Report.pdf Operation-Blockbuster-RAT-and-Staging-Report.pdf Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf Operation-Blockbuster-Destructive-Malware-Report.pdf

Preventions

<Mitigation techniques>

Detections

• A continuous service that monitors your website for changes.
• A large number of HTTP requests to a new resource
• A change in packet size when requesting a resource
• Webserver making external requests for resources

Toolkit

<Toolkit instructions, if applicable>

Similar techniques

• Exfiltration

References

• Website defacement