SOCRadar Profiles DieNet’s High-Volume DDoS Operations and Unverified Claims
Summary
SOCRadar profiles DieNet’s DDoS operations, reporting 59 attack claims in two days during the March 2026 escalation. It describes the group’s rented infrastructure and attack methods, while noting that its ransomware and OT/ICS claims remain unverified.
Key points
- SOCRadar reports DieNet recorded 59 distinct attack claims on March 2–3, 2026; the claims do not establish that every target experienced a successful disruption.
- The group relies on rented DDoS-as-a-Service infrastructure and uses TCP SYN/RST floods, DNS/NTP amplification, and application-layer attacks.
- DieNet’s claimed targets include government portals, financial institutions, telecoms, transportation, and healthcare organizations.
- The article says DieNet’s Locknet ransomware and OT/ICS access claims remain unverified; CloudSEK found the data behind a claimed 247 GB NIC India breach was mostly publicly available marketing material.
- SOCRadar reports shared DDoS infrastructure with OverFlame and DenBots Proof, and describes DieNet as a high-volume actor in the pro-Iran “Electronic Operations Room.”
- Recommended defenses include upstream filtering, cloud scrubbing or CDNs, WAFs and rate limits, phishing-resistant MFA, OT/IT segmentation, and monitoring the group’s Telegram channels.
Article Details
- Attack Vectors
- DieNet uses rented DDoS-as-a-Service infrastructure to conduct high-volume denial-of-service campaigns.
- Reported network-layer vectors include TCP SYN and RST floods, DNS amplification using open resolvers, and NTP amplification.
- Reported application-layer attacks target government portals, dashboards, and APIs.
- DieNet has claimed defacements, admin-panel takeovers, OT/ICS access, and data exfiltration; the article says these claims are largely unverified or exaggerated.
- The claimed 247 GB exfiltration from India's National Informatics Centre was reported by CloudSEK to consist almost entirely of publicly available marketing materials.
- Defensive Notes
- Coordinate with the ISP on upstream traffic filtering or blackhole routing for volumetric surges; use cloud-based scrubbing services or CDNs to absorb attack traffic.
- Use DNS protection and query rate limiting to reduce exposure to amplification attacks.
- Deploy WAF rules, rate limiting, and behavioral anomaly detection for application-layer floods; consider dynamic blocking of robotic traffic.
- Enforce phishing-resistant MFA and restrict external access to remote access, email, HR, and payroll systems.
- Disconnect internet-facing industrial control systems, segment IT and OT networks, and audit PLCs for unauthorized logic changes.
- Monitor DieNet Telegram channels for declared targets and campaign timing.
MITRE ATT&CK
T1491.001 · Internal DefacementDieNet has claimed public website defacements; the article cautions that these claims are largely unverified.T1498 · Network Denial of ServiceThe article identifies network denial of service as DieNet's primary confirmed activity, using DDoS campaigns against target organizations.T1498.001 · Direct Network FloodThe article reports TCP SYN and RST floods intended to exhaust server resources or terminate connections.T1498.002 · Reflection AmplificationThe article reports DNS and NTP amplification attacks that direct amplified traffic toward victims.T1499 · Endpoint Denial of ServiceThe article describes attacks intended to render specific endpoints and services unresponsive, including application-layer floods against portals, dashboards, and APIs.T1565 · Data ManipulationThe article describes inflated or staged breach claims, including the claimed 247 GB NIC exfiltration that CloudSEK found consisted almost entirely of public marketing materials.
Threat Actors
DieNetThe article describes DieNet as a pro-Iranian hacktivist group that claims DDoS attacks and has made largely unverified claims of ransomware use, data exfiltration, defacements, and OT/ICS access.Mad GhostThe article says Mad Ghost launched attacks using DieNet's DDoS infrastructure during the March 2026 campaign.NoName057(16)The article reports that NoName057(16) re-engaged Israeli targets and also targeted European infrastructure during the March 2026 escalation.RuskiNetThe article reports that RuskiNet began daily DDoS attacks on Israeli industrial targets during the March 2026 escalation.SYLHET GANG-SGThe article says Sylhet Gang-SG collaborated with DieNet and Team Azrael on attacks against Indian government portals, and forwarded DieNet attack claims through its channels.Team AzraelThe article says Team Azrael collaborated with DieNet and Sylhet Gang-SG to target Indian government portals.Z-Pentest AllianceThe article says Z-Pentest Alliance published claims of OT/ICS access against Israeli water infrastructure; the article does not independently verify the claims.
Malware
Products
Countries
Azerbaijanalso signaled intent to target Cyprus due to its hosting of British military bases, and has referenced Azerbaijan for its perceived ties to Israel and the U.S., expanding its targeting logic to any nation perceived asBahrain[Victim organizations ] Highâprofile targets cited in claims – Amazon Pay, NASDAQ, and many government portals across Kuwait, Bahrain, Israel, UAECyprusDieNet has also signaled intent to target Cyprus due to its hosting of British military bases, and has referenced Azerbaijan for its perceived ties to Israel and the U.S., expanding its targeting logic to any nationIndiaBeyond the Gulf: Israel, India, and New FrontiersIranThe group shares infrastructure with DaaS providers like OverFlame and DenBots Proof and acted as a highâvolume DDoS engine within the proâIran “Electronic Operations Room” during the 2026 conflict.Israelportals, financial institutions, telecoms, transportation, and healthcare across the U.S., Gulf states, Israel, and other countries; notable victim claims include Amazon Pay, NASDAQ, Port of Los Angeles, and NSOJordanand Ministry of Education; Saudi Arabia’s National Commercial Bank, Riyadh Bank, and Al Rajhi Bank; and Jordan’s Petra News Agency, National Cyber Security Center, and King Hussein International Airport.Kuwait[Victim organizations ] Highâprofile targets cited in claims – Amazon Pay, NASDAQ, and many government portals across Kuwait, Bahrain, Israel, UAEOmanTurkey, Poland, Saudi Arabia, Oman, QatarPakistanIn May 2025, DieNet expanded into South Asia during the India-Pakistan standoff following the Pahalgam crisis, collaborating with Sylhet Gang-SG and Team Azrael to target Indian government portals.PolandTurkey, Poland, Saudi Arabia, Oman, QatarQatarTurkey, Poland, Saudi Arabia, Oman, QatarSaudi ArabiaTurkey, Poland, Saudi Arabia, Oman, QatarTurkeyTurkey, Poland, Saudi Arabia, Oman, QatarUnited Statesinclude government portals, financial institutions, telecoms, transportation, and healthcare across the U.S., Gulf states, Israel, and other countries; notable victim claims include Amazon Pay, NASDAQ, Port of Los
Industries
AviationGovernment (Defense, Public Admin, Energy, Healthcare, IT, Telecom), Financial Services, Aviation, TransportationEnergyTargets spanned transportation (Port of Los Angeles, Chicago Transit Authority, LA Metro), energy (North American Electric Reliability Corporation, PJM Interconnection), finance (NASDAQ, Amazon Pay, The Clearing House),Financial ServicesGovernment (Defense, Public Admin, Energy, Healthcare, IT, Telecom), Financial Services, Aviation, TransportationGovernmentPrimary targets include government portals, financial institutions, telecoms, transportation, and healthcare across the U.S., Gulf states, Israel, and other countries; notable victim claims include Amazon Pay, NASDAQ,HealthcarePrimary targets include government portals, financial institutions, telecoms, transportation, and healthcare across the U.S., Gulf states, Israel, and other countries; notable victim claims include Amazon Pay, NASDAQ,Information TechnologyGovernment, Information TechnologyTelecommunicationsFinancial Services, NGO, Telecommunications, Legal, Aviation & AerospaceTransportationPrimary targets include government portals, financial institutions, telecoms, transportation, and healthcare across the U.S., Gulf states, Israel, and other countries; notable victim claims include Amazon Pay, NASDAQ,