Syrian Hackers Promote Assad Government by Vandalising Random Web Sites

The Syrian Electronic Army (SEA) has been getting a lot of press recently for successful phishing attacks against media outlets that they feel have painted an unfair picture of the Syrian government. In investigating hacked web servers used by spammers we’ve come across another, smaller, group supporting the Syrian Government. The SeCuR!TY LiONS HaCK3RS (sic) are not hacking into other peoples' web servers to send spam though. They are just doing it to deface the site with a pro-Assad message. Here's the file uploader they install:

Note the PHP begins with GIF89a1 indicating that this malware was uploaded as an image file and then renamed. Here's one of their defaced web sites:

This page even contains contact information for the members of the hacking team and a link to their Facebook page! The Facebook link shown above (https://www.facebook.com/Sec.Lions) is no longer active, but they can currently be found on https://www.facebook.com/Sec.Lions2.

The page contains notices of web sites they have hacked, and lists of hacked email accounts with passwords. They also have an Android App. Doesn't everyone? At least the SeCuR!TY LiONS are safely out of reach of US law enforcement for the time being. Here's a web site defaced by another Arab nationalist, R3d ErRor (sic):

Mister ErRor kindly keeps a list of the web sites he has defaced at zone-h.org. He is currently up to 1,385, though not all of them involve flag burning. (Quick quiz: How many mistakes can you spot in that attempt at a US flag, apart from the fact that it is on fire?) In a 2012 profile on a hacker web site R3d ErRor wrote:

If he really is in Washington, then I'm sure the NSA has his number. After all, the NSA has everybody's number.