{
	"id": "a2f26f76-949d-45c5-b91b-f975ac195c4f",
	"created_at": "2026-04-06T01:29:51.22234Z",
	"updated_at": "2026-04-10T03:33:17.937348Z",
	"deleted_at": null,
	"sha1_hash": "548f630697291a3709649d6da8a13ae6df239f16",
	"title": "Spanish giants the latest to fall foul of hackers",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1377293,
	"plain_text": "Spanish giants the latest to fall foul of hackers\r\nBy Shane Curtis\r\nArchived: 2026-04-06 00:37:27 UTC\r\nReal Madrid’s official Twitter account was hacked with a post announcing the signing of rival Lionel Messi.\r\n28 Aug 2017  •  , 1 min. read\r\nReal Madrid’s official Twitter account was hacked with a post announcing the signing of rival Lionel Messi\r\nappearing on their feed.\r\nThe hacking group known as OurMine, was behind the attacks on the Spanish giant and posted hoax claims of\r\nplayer transfers.\r\nThe group, which has been behind a series of high-profile hacks recently, claimed that Messi, the former multiple\r\nworld player of the year and Barcelona’s greatest ever player, had signed for Madrid.\r\nhttps://www.welivesecurity.com/2017/08/28/hacking-group-spanish-giants/\r\nPage 1 of 6\n\nThe post on the Madrid official Twitter account also accompanied by a video of Messi scoring for Barcelona\r\nagainst Real Madrid said “Benvingut Messi! !Bienvenido Messi! Welcome Messi! Bienvenue Messi! #Messi”.\r\nThe tweet remained visible for over an hour before it disappeared from both the Spanish and English social media\r\nlanguage feeds. The removable of the post was not quick enough to stop the post going viral with over 27,000\r\nretweets coming in the first 45 minutes.\r\nThe hacking group followed up this tweet with a series of tweets claiming responsibility for the hack saying:\r\n“Internet security is s*** and we proved that”.\r\nThe hack on the current UEFA Champions League holders came just days after their fiercest rivals, FC Barcelona,\r\nhad their social media accounts hacked with a post announcing the signing of Ángel Di María from Paris Saint-https://www.welivesecurity.com/2017/08/28/hacking-group-spanish-giants/\r\nPage 2 of 6\n\nGermain.\r\nhttps://www.welivesecurity.com/2017/08/28/hacking-group-spanish-giants/\r\nPage 3 of 6\n\nhttps://www.welivesecurity.com/2017/08/28/hacking-group-spanish-giants/\r\nPage 4 of 6\n\nThe Catalan club quickly released a statement confirming the incident: \"Our accounts have been hacked tonight.\r\nWe're working to solve the problem as soon as possible. Thanks for your patience.\"\r\nThis was the second time that the club fell victim to hackers having previously had their social media platforms\r\ncompromised in 2014 by a group claiming to be the Syrian Electronic Army.\r\nIt is difficult to ascertain what exactly is the aim of OurMine, is the group using these hacks to simply promote\r\ntheir group, or is there a more serious motive lurking in the dark that is yet to materialize?\r\nLet us keep you\r\nup to date\r\nSign up for our newsletters\r\nhttps://www.welivesecurity.com/2017/08/28/hacking-group-spanish-giants/\r\nPage 5 of 6\n\nSource: https://www.welivesecurity.com/2017/08/28/hacking-group-spanish-giants/\r\nhttps://www.welivesecurity.com/2017/08/28/hacking-group-spanish-giants/\r\nPage 6 of 6",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.welivesecurity.com/2017/08/28/hacking-group-spanish-giants/"
	],
	"report_names": [
		"hacking-group-spanish-giants"
	],
	"threat_actors": [
		{
			"id": "e4ccfe5c-4d77-4503-bf1c-36076dbd78d0",
			"created_at": "2022-10-25T16:07:24.522697Z",
			"updated_at": "2026-04-10T02:00:05.02215Z",
			"deleted_at": null,
			"main_name": "OurMine",
			"aliases": [
				"ATK 128",
				"TAG-HA10"
			],
			"source_name": "ETDA:OurMine",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "76fc6d92-0710-4640-bfa7-3000fe3940a5",
			"created_at": "2022-10-25T16:07:24.251595Z",
			"updated_at": "2026-04-10T02:00:04.911951Z",
			"deleted_at": null,
			"main_name": "Syrian Electronic Army (SEA)",
			"aliases": [
				"ATK 196",
				"Deadeye Jackal",
				"Syria Malware Team",
				"Syrian Electronic Army",
				"TAG-CT2"
			],
			"source_name": "ETDA:Syrian Electronic Army (SEA)",
			"tools": [
				"AndoServer",
				"CypherRat",
				"SLRat",
				"SandroRAT",
				"SilverHawk",
				"SpyNote",
				"SpyNote RAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "74f1da67-5bc9-49ee-ba8e-b7e8b452a2c2",
			"created_at": "2023-01-06T13:46:39.021238Z",
			"updated_at": "2026-04-10T02:00:03.183989Z",
			"deleted_at": null,
			"main_name": "OurMine",
			"aliases": [],
			"source_name": "MISPGALAXY:OurMine",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775438991,
	"ts_updated_at": 1775791997,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/548f630697291a3709649d6da8a13ae6df239f16.pdf",
		"text": "https://archive.orkl.eu/548f630697291a3709649d6da8a13ae6df239f16.txt",
		"img": "https://archive.orkl.eu/548f630697291a3709649d6da8a13ae6df239f16.jpg"
	}
}