It turned out that the pro-Assad Syrian hacker group, which names itself “the Syrian Electronic Army”, has targeted the websites of the Independent, the Daily Telegraph, OK magazine, the London Evening Standard and even the US National Hockey League. Indeed, a number of visitors to all those websites can see just a blank screen and a javascript popup telling them about the hack. It seems that the group has exploited a bug in a content delivery network (CDN).

Security experts blamed the advertising network because of the sporadic nature of the outages – those are quite difficult to replicate and spread over a number of websites. In the meantime, these symptoms are quite common for attacks delivered through an ad or content delivery network, which serves 3rd-party code across numerous websites.

The targets confirmed the suggestions of the experts: The Independent revealed that the hack came through the Gigya CDN. In this case, the hackers redirected some users to their website or displayed their messages by exploiting the DNS entry. As for The Telegraph, it has also mentioned that a part of its website run by a 3rd-party was compromised, but the company has already fixed the bug, with no user data being affected.

It is known that the Syrian Electronic Army is a state-sponsored group of hackers who operate under Bashar al-Assad’s regime in Syria. They have already attacked a number of targets since the Syrian civil war began three years ago. The list of victims includes the New York Times, the Huffington Post, the Guardian, the Sun and the Sunday Times. The most recent time the group was in the news for hacking was in June 2014.

Unlike many state-backed hack attacks, the Syrian Electronic Army tends to focus on very public targets. The group uses its successes to promote themselves and their views and gain publicity. The Army is also known for attacking its victims using a mixture of social engineering and “spear phishing”, instead of exploiting computer vulnerabilities.

For example, when the Syrian Electronic Army attacked the Guardian last year, they sent spoof emails to staff urging them to reset passwords via a malicious link. After stealing some passwords in such a way, they used them to gain greater access inside the portal and even compromise Twitter accounts linked to the paper.