Technique
Server Software Component: Web Shell (T1505.003)
A web shell is a small script that an attacker places on a web server.
Read more
Significant cyber incident
Hack of the Qatar News Agency (2017)
The Qatar News Agency hack happened in the early hours of 24 May 2017, when hackers took over the agency's website and social media accounts and posted false remarks attributed to the emir.
In short
The Qatar News Agency hack happened in the early hours of 24 May 2017, when hackers took over the agency's website and social media accounts and posted false remarks attributed to the emir. Saudi and UAE media repeated them, and on 5 June four states cut ties with Qatar. Qatar said a bug in the QNA site was exploited and linked the attack to those states. The UAE denied any role.
What happened
On 24 May 2017 a Qatari government statement said the Qatar News Agency website had been hacked by an unknown entity and that a false statement attributed to the emir had been published. A false story in Arabic, apparently from the foreign minister, also appeared on a hacked Twitter account. The fake report had the emir criticizing renewed tensions with Iran and suggesting President Trump might not last in power. The incident came days after President Trump met Gulf Arab leaders in Riyadh.
Qatar denied the remarks at once. A government spokesman said the emir made no speech at the graduation ceremony he attended. Official media in Saudi Arabia and the UAE still ran the remarks, and the authorities there blocked the main Al Jazeera website. On 5 June 2017 Saudi Arabia, the UAE, Bahrain and Egypt cut ties with Qatar.
Qatar opened an inquiry and asked the FBI for help. Its Ministry of Interior said on 7 June that the attack exploited a bug in the QNA website and that the hacking file had been installed in April. Later Qatari statements linked the attack to the states that cut ties. The UAE denied any role. Dates differ slightly by source (see the timeline).
Timeline
-
April 2017
The Qatari Ministry of Interior says the hacking file was installed on the QNA site in this month.
-
23 May 2017
Al Jazeera, in two later articles, gives this as the day of the hack; sources differ on the date.
-
24 May 2017, 12:13am
The Ministry of Interior says the fabricated news was published at this time.
-
24 May 2017
Qatar says the QNA site was hacked and the emir statement is false; Saudi and UAE media repeat it and the Al Jazeera site is blocked there.
-
5 June 2017
Saudi Arabia, the UAE, Bahrain and Egypt cut ties with Qatar.
-
7 June 2017
The Ministry of Interior reports preliminary findings: a bug in the QNA website was exploited. An FBI team has been in Doha for about a week.
-
20 June 2017
Qatar's attorney general says certain iPhones from the countries laying siege to Qatar were used; he does not name countries.
-
16 July 2017
The Washington Post reports, citing unnamed US intelligence officials, that senior UAE officials discussed the planned hack the day before.
-
17 July 2017
Qatar's government communication office says the report proves UAE involvement; the UAE denies it.
-
20 July 2017
Qatari officials say the attack was coordinated with one of the countries and the UAE benefited most, but stop short of accusing UAE officials directly.
-
10 January 2018
Qatar's foreign minister says the probe showed two countries were involved, without naming them (reported 11 January 2018).
How the attack worked
What the sources say about the method
The only technical account comes from Qatar’s Ministry of Interior. On 7 June 2017 it said the hackers used high technology and innovative methods by exploiting a bug in the QNA website. It said a hacking file was installed in April and used later to publish the fabricated news on 24 May 2017. The ministry said it would release full findings when the investigation ended. We found no later public technical report.
Reach beyond the website
The attackers also controlled the QNA social media accounts. A false story appeared on a hacked Twitter account. Qatar’s attorney general said on 20 June 2017 that certain iPhones from the countries laying siege to Qatar were used in the hack. Qatar’s officials said they could not confirm the attackers’ nationality or identity because ties were cut.
The sources name no ATT&CK technique, so none is listed.
Who says who was behind it
No neutral public attribution exists. Qatar's attorney general said on 20 June 2017 that certain iPhones from the countries laying siege to Qatar were used, without naming them. The Washington Post reported on 16 July 2017, citing unnamed US intelligence officials, that senior UAE officials discussed the planned hack the day before and that it was unclear whether the UAE hacked the sites or paid for it (as reported by Al Jazeera). The UAE minister of state for foreign affairs denied the report.
On 20 July 2017 Qatari officials said the attack was coordinated with one of the countries and that the UAE benefited most, but the head of the Qatari team stopped short of directly accusing UAE officials (reported by AP). On 10 January 2018 Qatar's foreign minister said the probe showed two countries were involved, without naming them. At the time, US and European officials said they had not yet determined who was behind it (reported 21 June 2017). Sources differ on the date: Qatar's Ministry of Interior gives 24 May 2017 at 12:13am; two Al Jazeera articles give 23 May.
Impact
The fake remarks were repeated by official media in Saudi Arabia and the UAE, and authorities there blocked the main Al Jazeera website. On 5 June 2017 Saudi Arabia, the UAE, Bahrain and Egypt cut diplomatic relations and land, air and sea links with Qatar. Al Jazeera says the hack set off this crisis. AP reports that the Washington Post said the false story was used as a pretext for it. The sources give no figures on cost.
Government and regulator response
- 24 May 2017: Qatar’s government communications office said the published statement had no basis, and the government said it would track down and prosecute the perpetrators.
- Late May to early June 2017: Qatar asked the United States for help and an FBI team worked in Doha.
- 7 June 2017: The Ministry of Interior gave preliminary findings (a bug in the QNA website, a file installed in April) and promised full findings later.
- 20 June 2017: The attorney general said certain iPhones from the countries laying siege to Qatar were used in the hack.
- 17 July 2017: Qatar called the act a breach of international law and said the investigation was ongoing.
- January 2018: The foreign minister said the investigation showed two countries were involved and vowed legal action.
Lessons
-
A news site is a political target
The false story was built to look like a real emir speech, and neighboring media repeated it within hours. Media and government sites need the same protection as core systems.
-
Fix web flaws before they are used
Qatar's Ministry of Interior said a bug in the QNA website was exploited. A file placed in April was only used on 24 May.
-
Attackers can wait
The hacking file sat on the site for weeks before the fake news was posted. Look for old, quiet access, not only new alerts.
-
Social accounts need their own protection
A hacked Twitter account carried a second false story. Government social media needs strong login controls.
-
Have a correction plan
Qatar denied the remarks the same day, yet other media kept repeating them for days. Plan how to reach audiences fast.
-
Keep evidence for outside review
Qatar asked the FBI to help and published only preliminary findings. Clean logs make attribution possible later.
What to check in your own organization
-
Patch internet-facing web systems
Check that your public news, publishing and content systems are patched and tested for common web flaws.
-
Hunt for old files
Look for unknown files and web shells placed weeks or months ago on public servers.
-
Lock social media accounts
Check that every official social account uses strong multi-factor login and a short list of admins.
-
Control publishing rights
Check who can publish on your news site and whether a second person must approve sensitive items.
-
Prepare a denial path
Write down who issues a fast public denial, in which channels, and how partners and media are told.
-
Keep logs long enough
Check that web and account logs reach back at least several months so late discoveries can be traced.
-
Know who to call
Agree in advance which national body and which partner agency you contact for help with a state-linked attack.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country Qatar Qatar is a small, wealthy Gulf state with a national cyber agency that runs yearly drills and sets security standards. Middle East
Questions
What happened to the Qatar News Agency in May 2017?
Its website and social media accounts were hacked and false remarks were posted in the name of the emir. Qatar's government said the statement was false.
Who was behind the hack?
No neutral authority has named the attackers. Qatar says the attack was linked to states that cut ties with it. The Washington Post reported, citing unnamed US officials, that the UAE was involved. The UAE denies any role.
How did the attackers get in?
Qatar's Ministry of Interior said a bug in the QNA website was exploited and a hacking file was installed in April 2017.
Did the FBI help?
Qatar asked the United States for help and an FBI team was in Doha in early June 2017, according to Al Jazeera.
When did it happen?
Sources differ. The Ministry of Interior says the fake news was published on 24 May 2017 at 12:13am. Two Al Jazeera articles give 23 May.
What did it lead to?
Saudi Arabia, the UAE, Bahrain and Egypt cut ties with Qatar on 5 June 2017, after earlier blocking Al Jazeera websites.
Sources
- Qatar to 'prosecute perpetrators' of QNA hacking Al Jazeera
- Qatar reveals preliminary results of QNA hacking probe Al Jazeera
- Qatar: QNA hacking linked to countries boycotting Doha Al Jazeera
- Qatar lashes out at UAE over QNA hacking Al Jazeera
- Qatar Suggests Cyberattack Emanated From a Gulf Neighbor Associated Press via VOA
- Qatar FM vows legal action over QNA hacking Al Jazeera
- Defacement, Technique T1491 - Enterprise MITRE ATT&CK
- Exploit Public-Facing Application, Technique T1190 - Enterprise MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.