Unit 42 Reports Iran-Related Cyber Activity Amid Regional Escalation
Summary
Unit 42 reports an active SMS campaign distributing a malicious RedAlert Android app and increased hacktivist activity amid Iran’s internet connectivity falling to 1–4%. It also summarizes actor claims and recommends defensive measures.
Key points
- Unit 42 identified an active SMS phishing campaign using a malicious replica of Israel’s Home Front Command RedAlert app to deliver mobile surveillance and data-exfiltration malware.
- Iran’s internet connectivity reportedly fell to 1–4% after the Feb. 28 strikes; Unit 42 assesses that this may hinder coordination by state-aligned actors based in Iran.
- The article describes a surge in hacktivist activity, estimated at about 60 groups, involving claimed DDoS, hack-and-leak, wiper and defacement operations.
- Handala Hack and other groups claimed compromises or attacks against organizations and infrastructure; these claims are not presented as independently confirmed incidents.
- Pro-Russian groups also claimed access to Israeli defense systems, including IDF networks and Iron Dome; the article attributes these assertions to the groups.
- Recommended precautions include offline backups, out-of-band verification, patching internet-facing assets, phishing training and continuity planning.
Article Details
- Event Type
- Escalation of cyber activity amid the February 28, 2026, US-Israel strikes on Iran, including an active SMS phishing campaign distributing a malicious RedAlert APK and reported disruptive operations by hacktivist and state-aligned groups.
- Impact
- Iranian internet connectivity reportedly fell to 1–4%, which Unit 42 assesses may limit near-term coordination and sophistication of Iran-based state-aligned activity. The article reports phishing delivering mobile surveillance and data-exfiltration malware, and describes DDoS, hack-and-leak, wiper, and defacement activity. Several groups claimed compromises or access to targeted systems; those claims are not independently confirmed in the article.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//api[.]ra-backup[.]com/analytics/submit.php | Analytics/submit endpoint reported as associated with the malicious mobile payload. |
| URL | hxxps[:]//bit[.]ly/4tWJhQh | Shortened phishing link identified in connection with delivery of the malicious APK. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article reports data exfiltration in hack-and-leak and other cyber operations.T1190 · Exploit Public-Facing ApplicationThe article identifies exploitation of known vulnerabilities as a technique used in reported Iran-aligned cyber operations.T1485 · Data DestructionThe article describes wiper attacks and data-wiping operations; some specific access and attack claims are attributed to the groups making them.T1491 · DefacementWebsite defacement is described as a tactic used in hacktivist campaigns.T1498 · Network Denial of ServiceThe article reports DDoS attacks by hacktivist groups against organizations and infrastructure.T1566 · PhishingUnit 42 reports an active SMS phishing campaign using a malicious RedAlert application replica.T1566.002 · Spearphishing LinkThe article describes links, including a shortened URL, sent by SMS to deliver the malicious APK and phishing lures.T1583 · Acquire InfrastructureThe article describes the use of covert infrastructure for espionage in its account of Iran-aligned operations.
Threat Actors
APT IRANDescribed as a pro-Iranian hacktivist collective known for hack-and-leak operations.CARDINALA pro-Russian hacktivist group that claimed to target IDF systems and infiltrate IDF networks. The article assesses it as state-aligned but likely operating independently of direct state funding.Cyb3rDrag0nzzNamed as one of the teams included in the Cyber Islamic Resistance, which the article says coordinates teams for disruptive cyber operations.Cyber Islamic ResistanceDescribed as a pro-Iranian umbrella collective coordinating teams for DDoS attacks, data-wiping operations, and website defacements; the article attributes specific compromise claims to the collective.Dark Storm TeamDescribed as a pro-Palestinian and pro-Iranian collective specializing in large-scale DDoS and ransomware; it reportedly claimed DDoS targeting of Israeli websites, including a bank. The article identifies DarkStorm and MRHELL112 as alternate names.DarkStormIdentified in the article as an alternate name for Dark Storm Team, which it describes as specializing in DDoS and ransomware activity.DieNetDescribed as a pro-Iran hacktivist group conducting DDoS attacks in the Middle East; it reportedly claimed attacks on targets in Bahrain and Saudi Arabia.Evil MarkhorsDescribed as a pro-Iranian group specializing in credential harvesting and identifying unpatched critical systems; it reportedly claimed to target an Israeli bank website.FAD TeamDescribed as a pro-regime group focused on wiper malware and permanent data destruction. It reportedly claimed unauthorized access to SCADA/PLC systems and control systems associated with an Israeli security services company.FatimionNamed as an alternate name used in reports for FAD Team, which the article describes as focused on wiper malware and data destruction.Fatimiyoun Cyber TeamNamed as an alternate name used in reports for FAD Team, which the article describes as focused on wiper malware and data destruction.HandalaA hacktivist persona linked by the article to Iran’s Ministry of Intelligence and Security (MOIS). It reportedly claimed responsibility for compromising an Israeli energy exploration company and Jordan’s fuel systems, among other activity.INCA ransomware-as-a-service group that reportedly listed an Israeli industrial machinery company on its leak site. The article identifies INC Ransomware as an alternate name.INC RansomIdentified in the article as an alternate name for Tarnished Scorpius, which reportedly listed an Israeli industrial machinery company on its leak site.MRHELL112Identified in the article as an alternate name for Dark Storm Team, which it describes as specializing in DDoS and ransomware activity.NoName057(16)A pro-Russian hacktivist group that claimed disruptive operations against Israeli municipal, political, telecommunications, and defense-related entities.RipperSecNamed as one of the teams included in the Cyber Islamic Resistance, which the article says coordinates teams for disruptive cyber operations.SerpensUnit 42’s constellation name for various Iranian state-sponsored actors; the article says these actors could increase or escalate activity.Sylhet GangDescribed as a message amplifier and recruitment engine for a pro-Iranian hacktivist front that participates in DDoS attacks. The article says it is also cited as Sylhet Gang-SG.SYLHET GANG-SGIdentified in the article as an alternate name for Sylhet Gang, which it describes as participating in DDoS attacks and supporting a pro-Iranian hacktivist front.The Islamic Cyber Resistance in Iraq – 313 TeamDescribed as an active pro-Iranian hacktivist cell, also identified in the article as Islamic Cyber Resistance in Iraq. It reportedly claimed targeting Kuwait government and military websites.
Vendors
Products
Countries
BahrainClaimed responsibility for attacking an airport in BahrainCanadaFigure 2. Handala Hack death threat email to U.S. and Canada influencers.Iran28, 2026, joint US-Israel kinetic operations triggered Iran’s internet connectivity to drop to 1–4%, degrading leadership and command-and-control capabilities and limiting near-term coordination by Iran-based stateIsrael28, 2026, the United States and Israel launched coordinated strikes (Operation Epic Fury / Operation Roaring Lion), triggering a multi-vector Iranian retaliatory campaign and a severe national internet outage thatJordanClaimed responsibility for compromising Jordan’s fuel systemsKuwaitClaimed responsibility for targeting the Kuwait Armed Forces websiteSaudi ArabiaClaimed responsibility for attacking Sharjeh Airport in Saudi ArabiaUnited Arab EmiratesClaimed responsibility via their public Telegram board for targeting an airport in the United Arab EmiratesUnited States28, 2026, the United States and Israel launched coordinated strikes (Operation Epic Fury / Operation Roaring Lion), triggering a multi-vector Iranian retaliatory campaign and a severe national internet outage that
Industries
Critical infrastructureto amplify impact (‘State-sponsored campaigns might target their victim’s supply-chains, critical infrastructure, vendors or providers.’)DefenseThe persona blends data exfiltration with cyber operations against the Israeli political and defense establishment.EnergyClaimed responsibility for compromising an Israeli energy exploration companyGovernmentClaimed responsibility for targeting the Kuwait Government websiteHealthcareClaimed to target Israeli civilian healthcare to create domestic pressure just days before the kinetic war broke outIndustrial machineryThe ransomware-as-a-service (RaaS) group Tarnished Scorpius (aka INC Ransomware) has listed on its leak site an Israeli industrial machinery company, and replaced the company logo with a swastika.