Loading story…
Multiple U.S. Army internet subdomains, including oil.army.mil and ai2c.army.mil, were defaced in an apparent 404 hijacking campaign that replaced error pages with pro-Kurdistan and anti-Trump messages. The altered pages also referenced U.S. Ambassador Tom Barrack, while the main site content did not appear to be changed. The affected properties were tied to the Army’s Open Innovation Lab and Artificial Intelligence Integration Center.
The Army said the impacted pages were hosted on a legacy third-party platform that was not connected to the Army enterprise network, and it removed the pages while an incident response investigation continued. Independent reporting said the affected sites appeared to use WordPress and Microsoft cloud infrastructure, but the intrusion vector and scope of any broader compromise remain unconfirmed. Researchers said the messaging was consistent with Kurdish hacktivist themes, though no perpetrator has been officially identified.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
The U.S. Army said the impacted pages were hosted on a legacy third-party platform not connected to the Army enterprise network, removed the affected pages, and began an ongoing incident response investigation. Officials said it remained unclear whether additional subdomains were affected or whether any deeper compromise had occurred.
Independent researcher Ronald Lovelace identified the defaced Army subdomains and reported that the affected sites were using WordPress and Microsoft cloud infrastructure. His findings also pointed to the pages being hosted on a legacy third-party platform.
Multiple U.S. Army internet subdomains, including oil.army.mil and ai2c.army.mil, displayed anti-Trump and pro-Kurdish messages on error pages in an apparent 404 hijacking campaign. The defacement appeared to affect hosted error-page content rather than core site content, and the intrusion vector was not confirmed.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
techcrunch.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Twitter’s website was briefly hijacked after attackers using the name **“Iranian Cyber Army”** compromised the company’s DNS records and redirected visitors to a black defacement page carrying political messages, an Iranian flag, and contact details. The outage lasted about an hour, and users attempting to reach `Twitter.com` were sent to the spoofed page instead of the service. Reporting indicated the redirection was carried out with a valid Twitter username and password, suggesting the incident stemmed from compromised internal credentials rather than a vulnerability at DNS provider Dyn. Twitter said the DNS issue was fixed quickly and that its API and platform applications continued operating during the disruption, while the attack drew added attention because of Twitter’s role in communications around Iran’s disputed election protests.
Jun 29, 2026
APT34, also tracked as **OilRig** and **Helix Kitten**, ran targeted phishing campaigns that used malicious Microsoft Word documents to deliver new malware closely related to the **SideTwist** backdoor. One lure posed as a Seychelles Licensing Authority registration form with pricing in Saudi riyals, indicating likely targeting in Saudi Arabia, while another impersonated marketing services firm **GGMS** to reach enterprise victims. In both cases, the documents dropped .NET payloads—identified as **Menorah** and **SystemFailureReporter.exe**—that gave the operators espionage capabilities including host fingerprinting, command execution, file listing, file upload, and file download. The malware established persistence through scheduled tasks, including **`OneDriveStandaloneUpdater`** and another task triggered every five minutes via an **`update.xml`** file. The implants communicated over HTTP with command-and-control infrastructure including **`tecforsc-001-site1.gtempurl.com`** and **`11.0.188.38:443`**, with one report noting that the latter, a U.S. Department of Defense-owned IP address, was likely a decoy or testing endpoint intended to shield operational infrastructure. Researchers said the activity shows APT34 continuing to evolve SideTwist-style tooling while relying on straightforward phishing and persistence methods for cyberespionage in the Middle East and against enterprise targets.
Aug 15, 2026
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026