Glossary term
Reconnaissance
Reconnaissance is the stage where an attacker gathers information to plan later operations.
Read more
Significant cyber incident
TV5Monde broadcast sabotage, 2015
On the evening of 8 April 2015, the French-language broadcaster TV5Monde lost all its channels, its website and its social media accounts in a destructive cyber attack.
In short
On the evening of 8 April 2015, the French-language broadcaster TV5Monde lost all its channels, its website and its social media accounts in a destructive cyber attack. A group calling itself the Cyber Caliphate claimed it, but the investigation later pointed to Russian hackers known as APT28. In April 2025 France's foreign ministry said the GRU used APT28 in this sabotage. It matters because it was an attack meant to destroy broadcast systems, not to steal data.
What happened
On Wednesday 8 April 2015 all TV5Monde channels went off air. The BBC says the director-general learned of it at 20:40 local time. The Guardian reported 11 channels and a blackout between 10pm and 1am, while the BBC says 12 channels, so sources differ on the details.
Messages from a group calling itself the Cyber Caliphate appeared on the channel’s Twitter and Facebook pages. The hackers also posted documents said to be identity cards and CVs of relatives of French soldiers. The Paris prosecutor’s office opened a terrorism investigation.
The attack was far more targeted than first reported. The BBC says the attackers had been inside the network since 23 January 2015 and built custom malware to corrupt the hardware that ran the broadcast. An engineer cut the machine where the attack was running off the internet, and that stopped it.
The French investigation later pointed away from Islamic State. The BBC reported in October 2016 that investigators linked the attack to a Russian group known as APT 28. In April 2025 the French foreign ministry said the GRU used APT28 in this sabotage.
Timeline
-
23 January 2015
The attackers first get into the TV5Monde network, according to the BBC.
-
8 April 2015, 20:40 local time
The first calls come in as all channels go off air and messages appear on the Twitter and Facebook pages (BBC).
-
8 to 9 April 2015
The Guardian reports a blackout between 10pm and 1am, with the Cyber Caliphate claiming the attack.
-
9 April 2015, 05:25 local time
One channel is restored (BBC).
-
9 April 2015
The Paris prosecutor's office opens a terrorism investigation and the culture minister plans an urgent meeting of media groups (Guardian).
-
9 April 2015, 6pm
TV5Monde has control of its social networks and broadcasts are back to normal, including live ones (Guardian).
-
1 October 2015
A senator asks the government for financial help for TV5Monde (Senate written question).
-
3 December 2015
The foreign ministry answers that ANSSI is advising TV5Monde and that French funds can be moved to technical costs.
-
10 October 2016
The BBC publishes the director-general's account and says an investigation points to Russian hackers (APT 28).
-
29 April 2025
France's foreign ministry says the GRU used APT28 in the sabotage of TV5Monde in 2015.
How the attack worked
Getting in and learning the system
The BBC says the attackers first got into the network on 23 January 2015, about 11 weeks before the broadcast stopped. They studied how TV5Monde sent out its signals. They used seven points of entry. Not all of them belonged to TV5Monde or were in France. One was a Netherlands company that supplied the remote controlled cameras in the studios.
Building a tool to break the broadcast
The attackers then built custom malicious software. It was made to corrupt the internet-connected hardware that controlled how the station worked, such as the encoders used to send programs out.
The day of the attack
On 8 April the malware spread. More systems were corrupted every minute. The jihadist messages on social media came at the same time. The BBC reports that investigators came to believe the attackers used these posts to cover their tracks. The sources opened do not give MITRE ATT&CK technique numbers for this attack, so none are listed.
Who says who was behind it
Who attributed it, and how firm it is
Claimed on 8 April 2015 by a group calling itself the Cyber Caliphate (BBC, Guardian).
Attributed by France's Ministry for Europe and Foreign Affairs, 29 April 2025: the GRU used the APT28 attack group in the sabotage of TV5Monde in 2015.
The BBC reported on 10 October 2016 that an investigation linked the attack to a group of Russian hackers known as APT 28. The director-general said investigators could not show why TV5Monde was chosen or who gave the order.
Impact
Broadcast: all channels went off air on 8 April 2015. The Guardian says normal service, including live broadcasts, returned by 6pm on 9 April.
Systems: the director-general said the company waited months before it reconnected to the internet, and staff used fax machines because email did not work (BBC).
Cost: the BBC reports 5 million euros in the first year and over 3 million euros each following year. A senator's written question forecast 4.3 million euros for 2015 and 3.4 million for 2016. These figures are not the same measure, so treat them as indications only.
Working practice: special checks now apply to email from abroad and flash drives are tested before use (BBC).
Government and regulator response
- 8 to 9 April 2015: an engineer isolated the machine where the attack was running. The Paris prosecutor’s office opened a terrorism investigation, and the culture minister planned an urgent meeting of media groups (Guardian).
- 2015: France’s cyber agency advised the director-general to say only that the messages claimed to be from Islamic State (BBC). ANSSI advised TV5Monde on rebuilding its systems and stronger protection (foreign ministry answer to the Senate, 3 December 2015).
- 3 December 2015: the ministry allowed TV5Monde to move part of the French contribution to technical costs (Senate answer).
- 29 April 2025: France’s foreign ministry condemned the use of APT28 by the GRU and named the TV5Monde sabotage among earlier cases.
Lessons
-
A claim of responsibility is not proof
The Cyber Caliphate claimed the attack, but the BBC reports investigators came to believe the posts covered the real actor's tracks. Wait for forensic work before naming anyone.
-
Suppliers are entry points
One of seven entry points was a Netherlands company that supplied studio cameras (BBC). Review the access your suppliers have.
-
Attackers prepare for weeks
The attackers were in the network from 23 January until 8 April (BBC). Look for quiet reconnaissance, not only for loud events.
-
Destructive attacks are different
The aim was to destroy the channel, not to steal data (BBC). Plan for rebuilding systems, not only for data loss.
-
Segment production systems
The Guardian quotes the director-general asking how the attack happened despite certified firewalls. Perimeter tools alone did not stop an attacker who was already inside.
-
Recovery takes years of budget
The BBC reports 5 million euros in year one and over 3 million euros a year after that for new protection.
What to check in your own organization
-
Supplier access
List every outside company with remote access to studio, production or control equipment and check how that access is protected.
-
Broadcast or production network
Confirm that systems that run production are separated from office email and web systems.
-
Offline recovery
Keep tested, offline copies of the software and settings of production hardware so it can be rebuilt after destruction.
-
Dwell time
Check how long an intruder could stay unseen. Review logs for unusual remote logins going back months.
-
Social media accounts
Protect broadcast and news accounts with strong sign-in and a plan to take them back quickly.
-
Crisis plan
Test a plan for staying on air or communicating with fax, phone or backup tools if email and systems are down.
-
Claims of responsibility
Agree in advance who speaks publicly and what they say before investigators confirm who did it.
Where it happened
Questions
What happened to TV5Monde in April 2015?
All its channels went off air on 8 April 2015 and its website and social media accounts were taken over. The BBC says the attack used custom malware built to destroy the broadcast systems.
Did Islamic State carry it out?
A group calling itself the Cyber Caliphate claimed it. The BBC reports that investigators came to believe those posts were meant to cover the real attackers' tracks.
Who is blamed?
France's foreign ministry said on 29 April 2025 that the GRU used the APT28 group in the sabotage of TV5Monde. The BBC reported in October 2016 that the investigation pointed to APT 28.
How many channels went off air?
Sources differ. The BBC says 12 channels. The Guardian reported 11 channels on 9 April 2015.
How much did it cost?
The BBC reports 5 million euros in the first year and over 3 million euros a year after that for new protection. A senator's written question forecast 4.3 million euros for 2015.
How was it stopped?
The BBC says an engineer found the machine where the attack was running and cut it off the internet.
Sources
- How France's TV5 was almost destroyed by 'Russian hackers' BBC News
- French media groups to hold emergency meeting after Isis cyber-attack The Guardian
- Aide financière urgente à TV5 Monde (written question 18038 and answer) Senate of France
- Russia - Attribution of cyber attacks on France to the Russian military intelligence service (APT28) Ministry for Europe and Foreign Affairs of France
- Commission de la culture, de l'éducation et de la communication : compte rendu de la semaine du 18 mai 2015 Senate of France
- Projet de loi de finances pour 2017 : Avances à l'audiovisuel public : France Médias Monde (P844), TV5 Monde (P847) Senate of France
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.