RegistroCiberVE
All incidents
website defacement Claim date: Date confidence: Medium

Presunta desfiguración del portal de CONATEL atribuida a The Binary Guardians

La supuesta desfiguración de www.conatel.gob.ve fue mostrada por The Binary Guardians en una publicación dirigida a @Conatel el 7 de agosto de 2017. La captura contiene el panfleto de Operación David, un video de Chaplin y mensajes políticos de la campaña. El Pitazo, EFE, IT Projects y El País también incluyeron a CONATEL entre los objetivos reclamados; El País informó que todos los portales citados operaban normalmente al final de la tarde. La captura aporta evidencia específica del contenido del portal, pero no es una adquisición forense independiente. Una declaración posterior del presidente de CANTV atribuyó redirecciones de dominios .ve a una intrusión en NIC.ve/DNS, dependencia de CONATEL; esa explicación no prueba el método usado contra conatel.gob.ve. No hay evidencia pública de acceso a sistemas internos, exfiltración ni impacto sobre datos.

Overview

Missing evidence

independent archived capture of conatel.gob.ve while altereddirect CONATEL statementtechnical indicators for the access methodindependent confirmation of the target-specific NIC.ve/DNS mechanism

Impact details

The Binary Guardians published a screenshot visibly showing altered political content at www.conatel.gob.ve. El País reported the cited portals operating normally by late afternoon. No target-specific outage, DNS method, internal-system access, confidentiality loss, data exposure, people impact or financial impact was established.

sitio web público

Classification & severity

Category
Information content security
Subtype
website defacement
Confidence
Medium

The actor account published a target-specific screenshot visibly showing www.conatel.gob.ve with the campaign defacement, and independent media report that the group claimed CONATEL. The screenshot is not an independent forensic acquisition; DNS redirection is not proven for this target.

Severity assessment

Low
Functional impact
Minimal
Information impact
Integrity loss
Affected scope
Single system
Critical service
None
Public confidence
Limited
Recoverability
Regular

Target-specific actor screenshot supports temporary public-content alteration, and El País reports normal operation by late afternoon. No critical regulatory service loss, outage duration, internal compromise or data impact was shown.

Integrity

Timeline

Claim

A las 15:00:45 UTC, la cuenta de The Binary Guardians dirigió un mensaje a @Conatel y publicó una captura de www.conatel.gob.ve mostrando el contenido alterado de la campaña.

Claim

The Binary Guardians difundió el mensaje político de la campaña y afirmó apoyar, sin formar parte, de Operación David.

Remediation

El País informó posteriormente que todos los portales citados operaban con normalidad al final de la tarde del 7 de agosto.

Evidence & sources

6 sources

Hackean al menos 25 páginas webs y llaman a protestar

Redacción El Pitazo / EFE Aug 7, 2017
Corroborating Media report Source confidence: High

What this source supports

  • The Binary Guardians was reported as claiming CONATEL in the campaign
  • CONATEL appears in a contemporaneous target list
  • the article reports at least 25 affected pages but does not individualize CONATEL state

Evidence limits

Contemporary media support for claimed target inclusion, partly EFE-derived; no CONATEL-specific capture or observed state in this article.

Relevance to this case

Corroborates that CONATEL was publicly named in the 7 August campaign.

Venezuela: hacktivistas en desobediencia civil electrónica realizan ataque masivo a portales web

IT Projects C.A. Aug 7, 2017
Corroborating Security research Source confidence: Medium

What this source supports

  • the article describes the broader campaign as defacement
  • the partial list includes the CONATEL domain
  • more than 30 portals were reported in the campaign

Evidence limits

Secondary technical/editorial account; no independent CONATEL screenshot, telemetry, access method or recovery observation.

Relevance to this case

Preserves exact-domain linkage but is not the strongest target-specific evidence.

“Hackean” webs de poderes públicos en Venezuela y llaman a protestar

EFE / El Economista Aug 7, 2017
Corroborating Media report Source confidence: High

What this source supports

  • EFE reports that The Binary Guardians claimed CONATEL among additional targets
  • EFE found most pages in the collective set hacked or not loading
  • the aggregate observation does not establish the specific condition of conatel.gob.ve

Evidence limits

Strong wire report for the actor claim and target list, but EFE does not say which observed condition applied to CONATEL.

Relevance to this case

Strongest stored contemporary target-list report; malformed unrelated claims removed.

Red de telecomunicaciones del Estado registró tres ataques simultáneos de extrema gravedad

Alba Ciudad / VTV; declaración de Manuel Fernández, presidente de CANTV Aug 10, 2017
Context Official statement Source confidence: Medium

What this source supports

  • Manuel Fernández alleged that NIC.ve/DNS was compromised from abroad
  • he described redirection of numerous official .ve pages
  • NIC.ve is a CONATEL dependency
  • the statement does not name conatel.gob.ve as an observed redirected target

Evidence limits

Official CANTV infrastructure allegation without public technical indicators; administrative linkage to CONATEL does not prove target-specific DNS compromise of conatel.gob.ve.

Relevance to this case

Retained only as attributed NIC.ve/DNS campaign context, not direct CONATEL portal-impact evidence.

Un ataque “hacker” tumba las webs gubernamentales en Venezuela

Alfredo Meza / El País Aug 8, 2017
Corroborating Media report Source confidence: High

What this source supports

  • El País reports that The Binary Guardians claimed CONATEL among about twenty official sites
  • the campaign placed political messages on government websites
  • all portals cited were operating normally by late afternoon

Evidence limits

Independent high-quality report of the actor claim and collective recovery; it does not say El País directly observed the CONATEL page while altered.

Relevance to this case

Independent target-name corroboration and same-day recovery evidence.

@Conatel ¿Qué pasó?, ¿Van a seguir apoyando la dictadura?

The Binary Guardians (@TBGuardians) Aug 7, 2017
Primary Threat actor claim Source confidence: Medium

What this source supports

  • the actor account directly addresses @Conatel
  • the attached 2048x1310 image visibly shows www.conatel.gob.ve serving the Operation David flyer, Chaplin video and campaign text
  • the post was published on 2017-08-07

Evidence limits

Primary evidence of the actor publication and target-specific screenshot, but not an independently authenticated forensic capture or proof of technical causation or access method.

Relevance to this case

Strongest target-specific evidence for visible public-content alteration and actor claim.