Report: Hacktivist Activity in the Iran-Israel Cyber Standoff Escalated in June 2025
Summary
CloudSek reports a June 2025 surge in pro-Iranian hacktivist activity against Israeli targets, while noting that many breach and impact claims were exaggerated, recycled, or unverified.
Key points
- The report identifies more than 35 pro-Iranian groups and 4–5 pro-Israeli groups active during June 12–18, 2025.
- Commonly reported tactics included DDoS attacks, website defacements, and data-leak claims targeting government, military, and critical infrastructure.
- The analysis says many groups exaggerated impact, claimed unrelated outages, or reused old leaks; the reported attacks were not independently verified.
- Across June 2024–June 2025, hacktivist campaigns were often tied to geopolitical events and used technically basic tactics, though some claims involved ICS attacks and ransomware.
- The report recommends DDoS protections, stronger credential security, monitoring hacktivist channels, incident-response plans, public communication, network segmentation, and security assessments.
Article Details
- Publisher
- CloudSek
- Report Period
- 2024-06 to 2025-06; escalation period 2025-06-12 to 2025-06-18
- Scope
- Hacktivist activity and claims related to the Iran-Israel cyber conflict, including attacks reported during June 12–18, 2025 and patterns observed from June 2024 to June 2025.
- Key Statistics
- The report identifies over 35 distinct pro-Iranian groups active during June 12–18, 2025.
- The report identifies 4–5 pro-Israeli groups responding during June 12–18, 2025.
- Recommendations
- Implement DDoS protections, including rate limiting and traffic filtering, for government and critical-infrastructure websites.
- Strengthen credential security with mandatory multi-factor authentication, regular password updates, and privileged access management.
- Monitor hacktivist Telegram channels and social media for early warning of planned campaigns.
- Establish incident-response procedures to assess breach claims and distinguish confirmed incidents from false or exaggerated claims.
- Assess public-facing assets regularly to identify and remediate misconfigurations.
Threat Actors
Anonymous OpIranListed for unspecified attacks against Iranian entities and IRGC facilities; the report does not verify the claims.APT IRANListed for data exfiltration and ransomware activity against Israeli academic and government systems; the report does not verify the claims.Arabian GhostsListed for DDoS attacks against the Bank of Israel and Barzilai Medical Center; the report does not verify the claims.BD AnonymousListed for data collection and doxxing involving Netanyahu's personal information and Israeli data; the report does not verify the claims.Cyber Fattah teamListed for cyberattacks and information warfare against Israeli infrastructure; the report does not verify the claims.Dark Storm TeamListed for website monitoring or targeting of Israeli government ministries; the report does not verify the claims.DieNetListed for data-breach and service-disruption activity against the Israel Antiquities Authority and radio stations; the report notes some consistency in this group's activity but does not verify individual claims.EvilMoroccoListed for claiming theft of 757 GB of Israeli infrastructure data; the report does not verify the claim.Fatah cyber teamListed for infrastructure attacks against Israeli systems; the report does not verify the claims.Fatimion Cyber TeamListed for attacks on government systems, the Israeli Air Force, and government sites; the report does not verify the claims.HackYourMomListed as conducting data-breach and credential-leak activity against multiple FTP and website systems; the report does not verify the claims.Handala HackListed for data-breach activity involving Israeli military systems and Delek Group; the report does not verify the claims.INTEIDListed for multi-sector attacks involving Israeli news, telecom, and medical organizations; the report does not verify the claims.Laneh/Team NestListed for infrastructure attacks against Israeli energy infrastructure; the report does not verify the claims.Lực Lượng Đặc Biệt Quân Đội Điện TửListed as conducting Layer 7 DDoS attacks against Israeli government sites and educational institutions; the report does not verify the claims.LulzSec Black 🇵🇸Listed as conducting DDoS and system-disruption activity against navigation, alert, and other infrastructure; the report does not verify the claims.MadCapZoneListed for an attack on the Tzofar alert system; the report does not verify the claim.Mr_HamzaNamed as using combined takedown and defacement strategies in the broader hacktivist activity discussed.Nation of SaviorsListed as conducting DDoS attacks against an Israeli government website; the report does not verify the claims.NoName057(16)Named as one of the groups for which the report observes some consistency; specific attacks are not detailed here.Predatory SparrowDescribed as conducting defensive operations that thwarted an alleged Iranian phone-battery attack.R3V0XAn0nymousListed for website attacks involving BNP Paribas Israel and the Ministry of Education; the report does not verify the claims.Red Wolf CyberListed for infrastructure attacks against the Israeli Ministry of Defense; the report does not verify the claims.REVOLUSI HIME666Listed for data-breach activity involving aurion-hosting.co.il; the report does not verify the claim.RipperSecNamed as using combined takedown and defacement strategies in the broader hacktivist activity discussed.RootSecListed for account hijacking involving Israeli Instagram accounts; the report does not verify the claim.SYLHET GANG-SGListed for service disruption involving the Tzofar Red Alert app and radio stations; the report does not verify the claims.Syrian Electronic ArmyListed for data-breach and infrastructure-targeting activity involving Iranian technology companies and claimed nuclear-facility targets; the report does not verify the claims.Team 1722Listed for agency compromise involving Israeli and US agencies; the report does not verify the claim.TEAM FEARLESListed as conducting DDoS attacks against an Israeli government website; the report does not verify the claims.TwoNetListed for DDoS attacks and data dumps involving Israeli defense and technology companies; the report does not verify the claims.Unified Islamic Cyber ResistanceListed for ICS attacks involving YBS electric-vehicle fleet management; the report does not verify the claims.
Products
Countries
IndiaPro-Palestinian/Islamist groups targeted Israel and India in response to military actions.IndonesiaAnti-Israel groups: Iran, Palestine, Indonesia, Lebanon, Yemen, international Anonymous affiliatesIranThe Iran-Israel conflict experienced a significant escalation in cyber hacktivist activity between June 12-18, 2025, with over 35 distinct pro-Iranian groups launching coordinated attacks against Israeli infrastructureIsraelThe Iran-Israel conflict experienced a significant escalation in cyber hacktivist activity between June 12-18, 2025, with over 35 distinct pro-Iranian groups launching coordinated attacks against Israeli infrastructureLebanonAnti-Israel groups: Iran, Palestine, Indonesia, Lebanon, Yemen, international Anonymous affiliatesPalestineAnti-Israel groups: Iran, Palestine, Indonesia, Lebanon, Yemen, international Anonymous affiliatesUnited KingdomYemenAnti-Israel groups: Iran, Palestine, Indonesia, Lebanon, Yemen, international Anonymous affiliates
Industries
AviationBankingCritical infrastructurewebsite defacements, and claimed data breaches targeting government sites, military systems, and critical infrastructure, mirroring the unsophisticated approach used consistently over the past year. Most significantly,EducationR3V0XAn0nymous Website attacks BNP Paribas Israel, Ministry of EducationEnergyLaneh/Team Nest Infrastructure attacks Israeli energy infrastructureGovernmentpredominantly consisted of DDoS assaults, website defacements, and claimed data breaches targeting government sites, military systems, and critical infrastructure, mirroring the unsophisticated approach usedHealthcareMilitaryconsisted of DDoS assaults, website defacements, and claimed data breaches targeting government sites, military systems, and critical infrastructure, mirroring the unsophisticated approach used consistently over theTelecommunications