Hacktivists and Extremist Groups React to Iran–Israel Conflict with Cyberattack Claims and Propaganda
Summary
DarkOwl reports increased hacktivist activity and cyberattack claims after U.S. and Israeli strikes on Iran, alongside Telegram-based propaganda and reactions from jihadist and Iranian-aligned groups.
Key points
- A Radware report cited by DarkOwl recorded 149 hacktivist-driven DDoS attacks against 110 organizations after the strikes; 107 targeted entities were in the Middle East.
- Hider Nex claimed a DDoS attack against an Israeli telecommunications company and later offered DDoS services and alleged data leaks for sale.
- Babayo Eror System claimed attacks against U.S. and Israeli websites, while other groups shared threats, conflict-related media, and unverified claims.
- A statement attributed to the Cyber Jihad Movement called for cyber operations against governments and institutions; DarkOwl says there is no public evidence of the group's operational capability.
- Islamic State supporters discussed the conflict on Rocket.Chat, including possible opportunities for ISKP and concerns about researcher and law-enforcement infiltration.
- Iranian-aligned militia channels shared alleged target lists and claimed a drone attack on a U.S. military base in Kuwait; the article does not independently verify the claim.
Article Details
- Event Type
- Cyber and information activity reported in response to the escalating Iran–Israel–United States conflict, including claimed hacktivist attacks, militant messaging, propaganda, and information sharing.
- Impact
- A Radware report cited by DarkOwl said 110 organizations were targeted in 149 hacktivist-driven DDoS attacks in the immediate aftermath of the U.S.-Israel campaign against Iran; 107 targeted entities were in the Middle East, primarily public infrastructure and government institutions. DarkOwl also reported unverified claims of attacks and alleged data leaks, and stated that there was no public evidence of operational capability associated with the Cyber Jihad Movement.
MITRE ATT&CK
People
Threat Actors
Ashab al-KahfTelegram channel described as affiliated with Iraqi Popular Mobilization Forces factions, including Kata’ib Sarkhat al-Quds; it posted a claim of responsibility for a drone attack on a U.S. military base in Kuwait.Babayo Eror SystemRussian-affiliated hacktivist group that claimed attacks against U.S. and Israeli websites.Hider NexTunisian hacktivist group that claimed a DDoS attack against an Israeli telecommunications company and reportedly continued targeting organizations in Israel.Islamic StateThe article describes supporters discussing the conflict on an unofficial Rocket.Chat server used by Islamic State sympathizers.Kata’ib HezbollahSafwa Unit claims affiliation with Kata’ib Hezbollah.Keymous+Pro-Russian collective that issued threats against Gulf states; its content was reposted by Babayo Eror System.Nation of SaviorsHacktivist group that changed its Telegram profile image to depict Ali Khamenei.Safwa UnitGroup that circulated graphics identifying alleged Israeli targets; it claims affiliation with Kata’ib Hezbollah.Z-BL4CX-H4TGroup that shared claims about Iranian attacks and claimed North Korean support for attacks against U.S.- and Israel-affiliated sites.
Products
Rocket.ChatDarkOwl monitors a range of Telegram and Rocket.Chat channels used by jihadist groups and their supporters, including communities linked to ISIS and al-Qaeda.TelegramSome groups have participated in cyberattacks, others have provided commentary, and many have used messaging platforms such as Telegram to share real-time updates.
Countries
AfghanistanThe document also announces the group’s “entry” into the Iran–United States conflict and the Afghanistan–Pakistan conflict, expressing support for the Pakistani Taliban (TTP) and the Islamic Emirate of AfghanistanIndiacyber operations targeting the governments and institutions of the United States, Israel, Pakistan, India, and several Arab countries, including cyberattacks designed to disrupt financial systems and governmentIranOn 28 February 2026, the United States and Israel launched airstrikes against Iran targeting key military commanders, nuclear facilities, and government infrastructure.IraqIranian-aligned militia groups across Iraq and the broader “Axis of Resistance” ecosystem have also used Telegram channels to shape narratives surrounding the conflict, combining operational claims, ideologicalIsraelOn 28 February 2026, the United States and Israel launched airstrikes against Iran targeting key military commanders, nuclear facilities, and government infrastructure.Kuwaitmilitary base in Kuwait using drones, warning that operations would escalate.North KoreaThe group also claimed that North Korea was supporting Iran in attacks against US and Israel affiliated sites.Pakistanto conduct cyber operations targeting the governments and institutions of the United States, Israel, Pakistan, India, and several Arab countries, including cyberattacks designed to disrupt financial systems andQatarMissile strikes were also reported in Saudi Arabia, the UAE, and Qatar.Saudi ArabiaMissile strikes were also reported in Saudi Arabia, the UAE, and Qatar.United StatesOn 28 February 2026, the United States and Israel launched airstrikes against Iran targeting key military commanders, nuclear facilities, and government infrastructure.
Industries
GovernmentOn 28 February 2026, the United States and Israel launched airstrikes against Iran targeting key military commanders, nuclear facilities, and government infrastructure.MilitaryOn 28 February 2026, the United States and Israel launched airstrikes against Iran targeting key military commanders, nuclear facilities, and government infrastructure.Public infrastructureOf these incidents, 107 were targeted entities in the Middle East, primarily focusing on public infrastructure and government institutions.TelecommunicationsThe Tunisian hacktivist group Hider Nex posted on 28 February, after a 10-day hiatus, claiming to have launched an attack against an Israeli telecommunications company in response to the strikes on Iran.