Hacktivists Deface US Army Websites to Taunt Trump

Two U.S. Army websites were fixed after hackers altered their error pages to display pro-Kurdish messages and insults targeting President Donald Trump, including the words “pedophile” and “thief,” according to TechCrunch.

The US Army websites defaced were tied to the Army’s Open Innovation Lab and AI Integration Center, public-facing sites connected to testing and integrating AI and other emerging technologies. The available reporting points to a visible hacktivist defacement, not a confirmed theft of Army data.

2 Army sites were fixed after anti-Trump messages hit error pages

The defacement did not appear to replace the main homepages. Security researcher Ronald Lovelace told CyberScoop, which first reported the incident, that the altered content appeared on error pages, meaning visitors saw it when trying to open a URL that did not exist.

CyberScoop identified the affected subdomains as oil.army.mil and ai2c.army.mil. The first belongs to the Open Innovation Lab, described as a test bed for software and cyber capabilities established in 2020. The second belongs to the Artificial Intelligence Integration Center, established in 2019 to integrate AI technologies into the Army and train personnel on emerging technologies.

The messages called Trump a “pedophile” and a “thief,” which were the hackers’ displayed words, not verified claims.

The defaced pages also mentioned Tom Barrack, the current U.S. ambassador to Turkey, and included calls for a “free Kurdistan.” CyberScoop reported that the altered pages were visible as of Monday, and that the Army took them down after the publication contacted officials.

“We are aware of unauthorized defacements on the error pages of oil.army.mil and ai2c.army.mil, which are hosted on a legacy, non-authoritative platform,” Army spokesperson Maj. Sean Minton told CyberScoop. “Technical teams took immediate action to mitigate the issue, and the affected pages have been secured.”

The Army has not said how the error pages were changed. TechCrunch reported that a Department of Defense spokesperson did not respond to its request for comment.

For readers tracking the broader collision of Trump politics and technology branding, this is a very different kind of Trump-linked tech story than XOOMAR’s coverage of the $499 Trump Phone flop. Here, the Trump connection comes through hostile political messaging planted on U.S. military web infrastructure.

US Army websites defaced through 404 pages put public trust on the line

A defacement is not the same thing as a confirmed breach of operational Army systems. There is no reported evidence so far that sensitive databases, internal military networks, or operational systems were accessed.

That distinction matters. But it does not make the incident harmless.

Public government websites carry institutional authority. When attackers can alter even a low-traffic error page on a military domain, they get to borrow that authority for their own message. In this case, the message was designed to provoke: anti-Trump insults, a pro-Kurdish slogan, and a reference to Barrack.

CyberScoop described the incident as a 404 hijacking campaign. In practical terms, that means attackers controlled what users saw when a requested page was missing, instead of necessarily changing the site’s normal visible pages.

The US Army websites defaced also appear to fit a familiar hacktivist pattern. The attackers did not quietly linger for financial gain, at least based on what is public. They used a federal web property to amplify a political cause.

That still leaves a hard question for federal web teams. A small public-facing compromise can expose weak maintenance, outdated software, loose access controls, or third-party hosting risk. CyberScoop reported that an Army spokesperson described the affected pages as hosted on a “legacy, non-authoritative platform” not connected to the Army’s enterprise network.

XOOMAR analysis: that wording is meant to limit the blast radius. It signals that the Army sees this as separate from its core network. It also raises a separate issue: legacy public platforms can still damage credibility when they carry official Army domains.

The political targeting also lands against a wider Trump news cycle. XOOMAR has covered other policy fights involving the president, including Trump wielding a housing bill in a SAVE Act pressure play and Trump losing as a U.S. housing law took effect without him. This cyber incident is narrower, but the attackers clearly chose Trump as the attention magnet.

Investigators now need the entry point behind 2 Army defacements

The next phase is forensic. Army cyber investigators will need to determine how attackers gained permission to alter the error pages, how long that access existed, and whether anything beyond the public-facing 404 pages was touched.

The likely review paths are straightforward:

• Logs: Identify when the altered pages were uploaded or generated.
• Credentials: Check whether administrative accounts were stolen, reused, or misconfigured.
• Content management system: Review WordPress instances, themes, and plug-ins for known weaknesses.
• Hosting layer: Examine the legacy third-party platform described by the Army.
• Scope: Confirm whether other Army subdomains showed abnormal changes or only the two named sites.

CyberScoop reported that Lovelace said the affected sites ran on WordPress and Microsoft cloud infrastructure. That does not prove WordPress or any plug-in caused the compromise. It does explain why investigators will look closely at the content management layer before assuming a deeper intrusion.

Lovelace said the presence across multiple subdomains “raises the severity a decent amount because it shows it’s a bit deeper than just one single path” being corrupted.

The Army’s public statement leaves several gaps. Officials have not publicly said exactly when the defacement began, whether a known group is suspected, or whether the third-party platform will be patched or discontinued. CyberScoop reported that incident response remains ongoing.

This is the watch item now: whether the US Army websites defaced remain a contained embarrassment on legacy web infrastructure, or whether investigators find broader weaknesses across public-facing military sites. The answer depends less on the slogans the attackers posted, and more on the access they had before the pages were secured.

Impact Analysis

• The incident exposed weaknesses on public-facing Army web infrastructure tied to emerging technology programs.
• Reporting indicates a visible hacktivist defacement rather than a confirmed theft of Army data.
• The use of political insults and pro-Kurdish messages shows how government sites can become targets for symbolic cyber protest.