• Publication Date July 25 2025
• Case Type Malicious Actor
• Tags Data Breach Data Leak Threat Actors Forums

Executive Summary

Multiple coordinated website defacement incidents have been detected on July 25, 2025, targeting educational and administrative web domains. The majority of affected sites belong to .div.edu.az and similar subdomains, with additional incidents reported against sectors in Myanmar and the United Kingdom. StealthMole’s cyber threat intelligence (CTI) platform has attributed the majority of these attacks to threat actors identified as P3RS14NB0Y, with a single event linked to Team_CC and another to 5YN15T3R_742.

Defacement Alert Overview

StealthMole's defacement alert system provides:

• Real-time incident detection: Automated crawlers and deep web scanning identify site content changes often indicative of defacement or compromise.
• Attribution and profiling: Alerts correlate file and page changes with known threat actor aliases derived from web shell, zone-h, or message drop signatures.
• Alert details: Each event lists the affected URL, actor name, timestamp (UTC), and target geography.

A defacement alert is triggered when the site’s content or core files are found altered, often including graffiti, threat actor signatures, or politically motivated messages. StealthMole then aggregates, verifies, and links evidence to existing threat actor profiles, providing actionable intelligence for cybersecurity professionals.

Defaced Websites: Timeline, Attribution, and Victim Geography

Below is a consolidated table summarizing the latest website defacement incidents, as detected and attributed by StealthMole’s threat intelligence platform. This data builds on your previous findings and highlights the scale, actors, and geographic scope of the attacks during the early hours of July 25, 2025.

Analysis of Bad Actor Activity