Report Maps Decentralized Pro-Iran Hacktivist Ecosystem and Its Disruption Tactics
Summary
A threat-intelligence report describes a decentralized pro-Iran cyber ecosystem that relies mainly on DDoS, defacement, hack-and-leak claims and propaganda to create disruption and psychological pressure, and outlines defensive priorities.
Key points
- The report describes a loose network of hacktivist, ideological and influence groups that coordinate through Telegram, shared target lists and public messaging, rather than a single command structure.
- Most observed activity consists of DDoS, defacements, recycled breach data, leak claims and propaganda amplification; the report assesses verified advanced intrusion and destructive capability as limited.
- The report says the ecosystem’s impact comes largely from rapid mobilization, visibility and coalition activity that can turn low-cost disruption into political, reputational and psychological pressure.
- A May 2026 DDoS campaign targeting Canonical and Ubuntu infrastructure reportedly affected ubuntu.com, Launchpad repositories, security-update APIs and related services; 313 Team claimed use of a DDoS-for-hire platform.
- The report highlights varied risks across groups, including Handala’s hack-and-leak and intimidation activity and Evil Markhors’ reported credential harvesting and reconnaissance.
- Recommended priorities include DDoS readiness, WAF and CDN hardening, credential-stuffing detection, MFA, leaked-credential monitoring, executive doxxing monitoring and procedures for responding to exaggerated breach claims.
- The report cautions that public claims, DDoS screenshots and leaked samples alone do not prove system compromise or current access.
Article Details
- Publisher
- DomainTools
- Report Period
- 2026
- Scope
- Pro-Iran and Axis of Resistance-aligned hacktivist ecosystem, its reported activity, and defensive implications.
- Recommendations
- Prepare DDoS readiness and harden WAF and CDN protections.
- Enforce MFA, detect credential stuffing, and monitor for leaked credentials.
- Monitor for executive doxxing and establish abuse-desk escalation procedures.
- Prepare rapid response and communications procedures for false or exaggerated breach claims.
MITRE ATT&CK
T1110.003 · Password SprayingThe report says Evil Markhors activities likely include password spraying.T1491 · DefacementThe report describes defacement operations.T1498 · Network Denial of ServiceThe report describes DDoS campaigns and disruption activity.T1595 · Active ScanningThe report says Evil Markhors activities likely include reconnaissance scanning.
Threat Actors
313 TeamNamed among groups in the pro-Iran cyber ecosystem.CARDINALIdentified in the report as an alias associated with Russian Legion and MONARCH.CEAAbbreviation used for Conquerors Electronic Army, which the report describes as a coalition-aligned DDoS and propaganda actor.Conquerors Electronic ArmyNamed among groups in the pro-Iran cyber ecosystem.Cyb3rDrag0nzDescribed as contributing to DDoS campaigns, Telegram amplification, and wartime disruption messaging.Cyber Islamic ResistanceNamed among groups in the pro-Iran cyber ecosystem.Cyber Isnaad FrontReportedly published target lists and conducted intimidation-oriented campaigns.Dark StormNamed among groups in the pro-Iran cyber ecosystem.Dark Storm TeamLinked in the report to DDoS campaigns, ransomware claims, and attacks targeting financial-sector organizations.DDoSiaProjectIdentified in the report as an alternate name for NoName057(16), which it describes as a pro-Russian hacktivist actor.DieNetDescribed as conducting persistent high-volume DDoS activity.Evil MarkhorsDescribed as focusing on credential harvesting, reconnaissance, and exposed-system discovery.Fatimiyoun Cyber TeamAlso referred to as FAD Team; associated with intimidation and escalation signaling.HandalaNamed among groups in the pro-Iran cyber ecosystem.Handala Hack TeamDescribed as conducting hack-and-leak operations, intimidation, identity exposure, and coercive information operations.Hider NexAlso known as Tunisian Maskers Cyber Force; associated with telecom-focused DDoS campaigns.Islamic Cyber Resistance in IraqAlso known as 313 Team; associated with DDoS and website disruption.Keymous+Described as a high-volume DDoS actor during the early 2026 wartime surge.Nation of SaviorsAlso abbreviated NOS; described as a coalition participant involved in DDoS and propaganda.NoName057(16)Also identified as DDoSiaProject; described as a pro-Russian hacktivist actor conducting high-volume DDoS operations.NOSAbbreviation used for Nation of Saviors, described as a coalition participant involved in DDoS and propaganda.RipperSecDescribed as a coalition-aligned hacktivist group focused on DDoS, defacement, and propaganda amplification.Russian LegionThe report says this actor increasingly uses the name MONARCH and also identifies CARDINAL as an alias.Server KillersDescribed as an opportunistic actor associated with nuisance disruption and DDoS activity.Tunisian Maskers Cyber ForceAlso known as Hider Nex; associated with telecom-focused DDoS campaigns.
Vendors
Products
Tools
Countries
Iranconflict and regional tensions has produced a decentralized wartime cyber ecosystem in service of Iran. It is not a single organized force, instead, it is a loose mix of jihadist-aligned cyber collectives,IraqIslamic Cyber Resistance in Iraq / 313 TeamIsraelNation of Saviors is a smaller coalition participant operating within pro-Palestinian and anti-Israel narratives. Its significance lies primarily in coalition breadth and amplification rather than technicalKuwaitAI-generated propaganda, and defacement-style activity against government and institutional targets in Kuwait and the wider Gulf. 313 Team operates inside the broader coalition environment of similar groups.Malaysiaa coalition-aligned hacktivist group focused on DDoS, defacement, and propaganda amplification based in Malaysia. The group’s importance lies in demonstrating how the ecosystem absorbs or aligns with preexistingRussiaUnited StatesThe group’s public statements call for “global cyber jihad” against the United States, Israel, and allied governments. This messaging signals a tactical convergence between historically hostile ideological ecosystems
Industries
financeTargeting is often symbolic, with activity directed against government, telecommunications, healthcare, finance, logistics, and open-source infrastructure that is aligned with, or within the borders of, the enemies ofGovernmentand extortion-style messaging. Targeting is often symbolic, with activity directed against government, telecommunications, healthcare, finance, logistics, and open-source infrastructure that is alignedHealthcaremessaging. Targeting is often symbolic, with activity directed against government, telecommunications, healthcare, finance, logistics, and open-source infrastructure that is aligned with, or within the borders of, thelogisticsis often symbolic, with activity directed against government, telecommunications, healthcare, finance, logistics, and open-source infrastructure that is aligned with, or within the borders of, the enemies of the stateTelecommunicationsextortion-style messaging. Targeting is often symbolic, with activity directed against government, telecommunications, healthcare, finance, logistics, and open-source infrastructure that is aligned with, or within the