Loading threat actor…
OverFlame is a hacktivist brand active in the cyber activity surrounding the Iran-Israel conflict and related regional campaigns. Available reporting links it to disruptive operations against Gulf Cooperation Council critical infrastructure portals, governmental systems, and energy facilities, and to a broader ecosystem of aligned hacktivist groups conducting politically motivated cyber operations. The group has been mentioned alongside CyberTroops and has been described as affiliated or partnered with other pro-Iranian or anti-Israel actors in coordinated campaigns. Observed activity associated with OverFlame is primarily disruptive rather than covert or technically sophisticated. It has been tied to coordinated attacks on government-facing and critical-service web infrastructure and to shared DDoS-as-a-service infrastructure used by other hacktivist groups. Reporting also places it in cooperation with Russia-based hacktivist elements targeting energy facilities. In the regional escalation of early 2026, OverFlame was named among groups involved in disruptive targeting of GCC government and critical infrastructure systems, while broader exfiltration claims in that ecosystem were often mixed with propaganda and unevenly verified. High-confidence information supports characterizing OverFlame chiefly as a politically aligned disruptive actor focused on denial-of-service style operations and symbolic targeting of public-sector and critical infrastructure entities. Claims of deeper intrusion or more advanced capabilities are not sufficiently corroborated in the available material.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist or disruptive actor sharing DDoS-as-a-service infrastructure with DieNet.
Hacktivist/disruptive activity targeting GCC critical infrastructure portals and government systems.
Hacktivist group involved in coordinated disruptive campaigns against GCC critical infrastructure portals and government systems.
Mentioned only as an entity that TwoNet claims ties to; no specific operations, tooling, victims, or TTPs are described in the provided content.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.