Mysterious Team Bangladesh Targets Multiple UAE Government Websites with DDoS Attacks Under #OpUAE Campaign

CloudSEK’s contextual AI digital risk platform XVigil discovered a post made by a hacktivist group “Mysterious Team Bangladesh” claiming to have conducted a DDoS attack on Multiple UAE government websites.
Updated on
May 29, 2023
Published on
May 29, 2023
Subscribe to the latest industry news, threats and resources.

On 20th May 2023, CloudSEK’s contextual AI digital risk platform XVigil discovered a post made by a hacktivist group “Mysterious Team Bangladesh” claiming to have conducted a DDoS attack on Multiple UAE government websites. To establish proof of conducting a successful DDoS attack, evidence was shared along with the actor’s Telegram post. The actors shared links to, a web utility that provides real-time information on whether a domain or an IP address is available and responsive - whenever a user tries to reach it. (Refer to the Appendix for more details)

The group is known to use DDOS attacks to harm reputed organizations and government infrastructure.

'Anonymous Sudan’ and other notable hacktivist groups targeting the UAE are both geographically motivated due to political concerns surrounding Sudan's conflict and alleged UAE involvement. The groups exhibit similarities in targeting patterns and geographic focus.

Snapshot from the Telegram Group of MTB

To Note:
Based on past observation, the hacktivist groups have been seen targeting the same set of Government, banking, fintech, etc entities repeatedly, considering their success for the first few times. Also, this is largely done to maintain the traction for their campaigns and gain publicity. 

Information from the Post

The websites targeted by the hacktivist group in this incident are:

Government Websites Targeted in the DDoS Attack

Ministry of Defence : Official Government Portal

Ministry of Energy & Infrastructure : Ministry of Health & Prevention

DDoS Attacks Information & Mitigation

These groups do not use sophisticated attacks, they are primarily known to DDOS and mass scan for sensitive information like backups, SQL files that are exposed. Based on analyzing the activity of the service and Telegram channel we were able to discover methodologies that the group uses to conduct DDoS or DOS attacks as follows:

Threat Actor Profile: Mysterious Team aka Misterious_Team

New TTPs for the group 

After tracking the group for quite some time we have gained information regarding the new toolset that they have started using, this includes:

  • Raven-Storm toolkit: It is a Python-based tool that can be used for multiple-layer DDoS attacks. The toolkit supports L3(ping), L4(UDP/TCP services) as well as L7(Websites) DDoS attacks. The tool also supports a server mode that connects multiple instances of raven-storm and creates a small botnet. A detailed analysis of the toolset can be found in a previous blog.
  • Xerxes: A simple C program that was used by ‘Jester’ to DDoS WikiLeaks and since has gained popularity. The framework works by maintaining a full TCP connection. After making a full TCP Connection it only requires a few hundred requests at long term in regular intervals.
  • Hulk: Another Python (now rewritten in GO) based program that stands for ‘HTTP-Unbearable-Load-King’ is another DDoS tool. This tool utilizes the lightweight Go-routines to start a high number of connection pools.

Past TTPs for the group 

The group can be attributed to abusing the HTTP Flooding attack method and DDos utilizing multiple scripts for DDoS attacks, resembling the TTP of the DragonForce group.

  • A tool called “./” could have been used to conduct the attacks on the mentioned websites, based on the present data available. The same tool was used and abused by the DragonForce group to target the Indian Army veteran website, the BJP website, and more in the past. 
  • More additional details and analyses of the tool have been conducted in the TTP report of the DragonForce group.

Impact & Mitigation


  • DDoS can leave websites more vulnerable as some security features may be offline due to the attack.
  • Damaged infrastructure can cause the collapse of services provided by the website.
  • Websites become vulnerable to further attacks.
  • Discrepancies for users accessing affected websites and resources


  • Deploy load balancers to distribute traffic.
  • Enable rate-limiting mechanisms.
  • Configure firewalls and routers to filter and block traffic.
  • Utilize content delivery networks (CDNs) to distribute traffic.
  • Implement bot-detection technologies and algorithms -to identify large-scale web requests from botnets employed by actors to conduct DDOS Attacks



Check host Snapshot for the Website status

Get Global Threat Intelligence on Real Time

Protect your business from cyber threats with real-time global threat intelligence data.. 30-day free and No Commitment Trial.
Schedule a Demo
Real time Threat Intelligence Data
More information and context about Underground Chatter
On-Demand Research Services
Dashboard mockup
Global Threat Intelligence Feed

Protect and proceed with Actionable Intelligence

The Global Cyber Threat Intelligence Feed is an innovative platform that gathers information from various sources to help businesses and organizations stay ahead of potential cyber-attacks. This feed provides real-time updates on cyber threats, including malware, phishing scams, and other forms of cybercrime.
Trusted by 400+ Top organisations