U.S. Army Websites Defaced in Anti-Trump Hacktivist Attack

The U.S. Army runs an Artificial Intelligence Integration Center . Its job is bringing cutting-edge AI into military operations. Hacktivists just embarrassed it by exploiting a forgotten error page — the digital equivalent of spray-painting your lobby while security cameras point at the vault. Two Army subdomain s, oil.army.mil and ai2c.army.mil, displayed messages calling Trump a “pedophile” and a “thief,” referencing his name in DOJ files connected to Jeffrey Epstein, alongside demands to “FREE KURDISTAN.” This is a federal cybersecurity story wearing political graffiti as a costume, not unlike the recent case where U.S. operatives built a surveillance app to target political dissidents.

Attackers hijacked 404 error pages on two Army innovation sites, hiding in plain sight while the rest of each site looked completely normal.

The defaced pages included “Kurdish sr was here” and referenced U.S. Ambassador to Türkiye Tom Barrack . Attribution remains unconfirmed, but CyberScoop notes “Technical teams took immediate action to mitigate the issue, and the affected pages have been secured.” The messaging is consistent with Kurdish hacktivist groups, who have long targeted government websites to amplify calls for autonomy across Turkey, Iraq, Iran, and Syria.

The Army hasn’t disclosed exactly how attackers gained access. TechCrunch observed both sites appear to run on WordPress with multiple plugins — a sprawling attack surface that administrators rarely audit. A 404 error page is the corner of a website nobody thinks . That’s precisely what made it useful.

Federal public-facing web infrastructure has become a soft target for politically motivated actors chasing visibility over data.

Hacktivists earlier targeted DHS, publishing records tied to ICE deportation contracts. That same week, DHS confirmed attackers compromised an intelligence-sharing platform used between state, local, and federal authorities, according to TechCrunch. SC World notes a 2015 Syrian Electronic Army attack defaced Army websites using similar tactics — this playbook predates TikTok by nearly a decade.

The Army’s “legacy platform” framing deserves a raised eyebrow: calling compromised public-facing infrastructure legacy doesn’t reduce the reputational damage of having an AI integration lab outmaneuvered by a forgotten plugin. Federal agencies face mounting pressure to audit CMS-based properties and harden configurations, as hackers have shown they can steal password vaults through similarly overlooked platform weaknesses. Defacement is cheap. Embarrassment is expensive. The fix isn’t glamorous — it’s patch management , a lesson underscored by the long history of tech scandals where institutions failed to act on known vulnerabilities.