Loading threat actor…
Altoufan Team, also rendered as ALTOUFAN TEAM, AL Toufan, Al-Toufan, al_toufan, and altoufan_team, is a pro-Iranian threat persona operating within the broader Iran-aligned hacktivist and proxy ecosystem active across the Middle East. The group has been linked to the Islamic Revolutionary Guard Corps and is assessed as part of the Iraq-Iran cyber corridor alongside actors such as 313 Team, Fatimion Cyber Team, FAD Team, Liwaa Mohammad, AL_Safwa313, Unit 313, Gaza313, Islamic Cyber Resistance, and Cyber Isnaad Front. Reporting also ties the revived Altoufan Team persona to Cotton Sandstorm, an Iranian state-linked actor associated with the IRGC Cyber-Electronic Command. Altoufan Team has publicly framed its operations around anti-Israel and anti-U.S. messaging and broader Axis of Resistance narratives. It has claimed disruptive operations against targets in Israel, Bahrain, Kuwait, and Jordan, and has been used to amplify antisemitic and retaliatory propaganda themes directed at U.S. allies in the Gulf. Early observed activity was consistent with publicity-oriented distributed denial-of-service campaigns against public-facing government, media, aviation, and commercial services, often coordinated through messaging channels with other Iran-aligned groups. The group’s claimed operations later expanded beyond short-lived website disruption to include website compromise claims and purported industrial-control or SCADA-related intrusions. Notably, Altoufan Team claimed compromise of a Jordanian grain and supply organization and manipulation of operational parameters in silo-related systems, indicating an asserted shift from symbolic disruption toward critical-infrastructure targeting. As with many regional hacktivist actors, some claims may exceed independently verified impact, but the group is consistently associated with disruptive operations, propaganda amplification, and escalation narratives during periods of regional conflict. Altoufan Team’s operational profile aligns with deniable proxy activity: coordinated messaging, rapid claim publication, ideological branding, and participation in broader anti-Israel and anti-Western cyber campaigns. Its capabilities, as directly supported, center on initial access claims, distributed denial-of-service activity, reconnaissance or probing associated with internet-facing targets, and post-compromise publicity and disruption rather than long-term stealth espionage. The actor’s dominant motivation is ideological and geopolitical alignment with Iranian interests rather than purely financial gain.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-aligned hacktivist group involved in Gulf cyber campaign activity, especially through coordinated messaging, disruption claims, and broader intrusion narratives.
IRGC-linked pro-Iranian group conducting early retaliatory operations, including DDoS, website compromise claims, and later claimed intrusions into SCADA/industrial control environments in Jordan and against U.S./Israeli-linked regional targets.
Group targeting Bahrain as part of influence and social-polarization operations tied to antisemitic messaging and provocation.
Iraqi territory-based pro-Iran cyber proxy group within the Islamic Cyber Resistance ecosystem.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.