Leakers$ Group Hijacks Digital Billboard Content Management Systems in Egypt, Malaysia, Brazil to Display Explicit Footage
A threat group calling itself Leakers$ claims to have compromised internet-exposed content-management software used to push content to digital billboards, resulting in explicit footage being displayed on large public screens in Egypt, Malaysia, and Brazil. The group states it did not breach individual billboards but instead accessed the centralized software platform that distributes content to LED displays, and claims to have discovered thousands of exposed systems during roughly two hours of automated scanning. On October 29, explicit footage appeared on a billboard overlooking a major highway in Egypt, with attacker aliases and a Telegram channel overlaid on the video; Egyptian authorities confirmed the billboard operator's website was compromised, causing unauthorized footage to appear in multiple countries simultaneously. The group also claims access to systems in Iraq and China, though these claims are less corroborated. The incident highlights risks tied to internet-exposed remote management systems, echoing recent attacks on refrigeration systems in European supermarkets.
Entenda a falha
A vulnerabilidade
No CVE, vendor or product name is public. Per a Leakers$ representative speaking to The Cairo Report, the group exploited a vulnerability in content-transmission software, plus weaknesses reachable through the systems' own web pages and interfaces. The target was the internet-exposed content-management platform that feeds digital billboards, not the screens themselves. Success gave the attackers control over what the billboards display. Affected and fixed versions are not stated. All of this is the group's own account.
Como funciona
Operators use a central content-management platform to send videos and ads to LED displays at many sites. According to the group, it scanned the internet automatically and found thousands of reachable management systems in about two hours. It then abused the content-transmission software and web-interface weaknesses to get into the platform. Once inside, it could replace the legitimate content, which was then pushed to the screens. The articles do not give the exact step where the software fails.
Por que é vulnerável
The articles do not state a technical root cause. What they do describe is management systems left reachable from the public internet, which makes them easy to find by scanning, plus an unspecified flaw in the content-transmission software and weaknesses in the web interfaces. Malwarebytes notes that a flaw in software shared across many installations scales beyond a single billboard. The Out of Home Advertising Association of America's guidelines point to default or reused passwords and missing MFA as typical weaknesses, but no article says these were used here.
Como foi descoberta
The incident came to light through public display: on October 29 explicit footage appeared on a billboard over a major highway in Egypt, with the attackers' aliases and a Telegram channel overlaid, and similar events were reported in Malaysia and Brazil. Egyptian authorities said the billboard operator's website was compromised, affecting several countries at once. Leakers$ claimed responsibility and told The Cairo Report it found the systems by automated scanning. It also claims access in Iraq and China, which is less corroborated. No coordinated disclosure or vendor advisory is mentioned.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 10:20.
Detalhes técnicos
According to a Leakers$ representative speaking to The Cairo Report, the attack exploited a vulnerability in content-transmission software combined with weaknesses accessible via the systems' own web interfaces, allowing discovery of numerous exposed management platforms via automated internet scanning rather than physical access to individual screens.
Remediação
The Out of Home Advertising Association of America's security guidelines recommend operators avoid default or reused manufacturer passwords, restrict access to management services, enable multifactor authentication, and protect remote connections with a VPN. Additional recommendations include restricting management access from the public internet, keeping signage software, controllers, and networking equipment updated, auditing third-party/supplier access, and monitoring systems with a rehearsed response plan to quickly halt unauthorized access.
Linha do tempo
-
Leakers$ Group Hijacks Digital Billboard Content Management Systems in Egypt, Malaysia, Brazil to Display Explicit Footage
ler a análise desta fonte ocultar
A threat group calling itself Leakers$ claims to have compromised internet-exposed content-management software used to push content to digital billboards, resulting in explicit footage being displayed on large public screens in Egypt, Malaysia, and Brazil. The group states it did not breach individual billboards but instead accessed the centralized software platform that distributes content to LED displays, and claims to have discovered thousands of exposed systems during roughly two hours of automated scanning. On October 29, explicit footage appeared on a billboard overlooking a major highway in Egypt, with attacker aliases and a Telegram channel overlaid on the video; Egyptian authorities confirmed the billboard operator's website was compromised, causing unauthorized footage to appear in multiple countries simultaneously. The group also claims access to systems in Iraq and China, though these claims are less corroborated. The incident highlights risks tied to internet-exposed remote management systems, echoing recent attacks on refrigeration systems in European supermarkets.
Technical Details
According to a Leakers$ representative speaking to The Cairo Report, the attack exploited a vulnerability in content-transmission software combined with weaknesses accessible via the systems' own web interfaces, allowing discovery of numerous exposed management platforms via automated internet scanning rather than physical access to individual screens.
Remediation
The Out of Home Advertising Association of America's security guidelines recommend operators avoid default or reused manufacturer passwords, restrict access to management services, enable multifactor authentication, and protect remote connections with a VPN. Additional recommendations include restricting management access from the public internet, keeping signage software, controllers, and networking equipment updated, auditing third-party/supplier access, and monitoring systems with a rehearsed response plan to quickly halt unauthorized access.