Loading threat actor…
CyberCaliphate is a purported pro-Islamic State hacktivist persona that emerged in late 2014 and publicly claimed disruptive and propaganda-oriented cyber incidents, including social-media account takeovers, defacements, and the high-profile sabotage of TV5Monde in 2015. The name has also been associated with doxing activity targeting military and government personnel and with messaging intended to incite violence by supporters of the Islamic State. Reported operations attributed to the persona included compromises of media and government-adjacent targets and public leak activity framed as jihadist cyber action. Multiple investigations and later public reporting assessed that CyberCaliphate functioned at least in part as a false-flag or cover persona rather than a standalone, authentic Islamic State hacking organization. High-confidence reporting linked infrastructure associated with the TV5Monde incident and related CyberCaliphate activity to Sofacy, also known as APT28 or Fancy Bear, a threat actor widely assessed as tied to Russian military intelligence. CyberCaliphate is therefore best understood as a deceptive front used in hack-and-leak or disruptive operations to obscure attribution and provide plausible deniability. Activity associated with the persona has included initial compromise of victim environments, disruptive actions against broadcasting and online services, public defacement, data exposure, and information operations through claimed responsibility and staged branding. Known aliases and related naming variants include Cyber Caliphate, cybercaliphate, and CyberCaliphate (false flag).
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as the group that claimed responsibility for the earlier TV5 Monde sabotage, as background comparison to the current case.
Hacktivist/terror-linked doxxing activity publishing personal details of mostly US military and government personnel and encouraging supporters to carry out physical attacks.
Islamic State-affiliated hacking group referenced as using cyber services and hacking websites as part of pro-ISIS online operations.
Islamic State-affiliated hacking group referenced as conducting website compromises and using protected hosting services while participating in the broader online propaganda and hacking ecosystem around the Islamic State.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.