Loading threat actor…
Cyber Toufan is an Iran-aligned anti-Israel hacktivist persona and suspected state-linked threat operation that has been active since at least 2023. It is widely described as part of the broader Iranian proxy and false-flag online ecosystem associated with the so-called Resistance Axis, and has been referenced alongside other Iran-aligned personas such as Handala, Cyber Support Front, Iranian Avenger, DieNet, APTIran, and Cyb3r Drag0nz. Some reporting characterizes it as a suspected Iranian state-sponsored operation, while other reporting leaves its precise organizational affiliation unknown. The group primarily targets Israeli organizations, especially the defense sector and other corporations, and has also been linked to activity affecting allied or defense-adjacent interests outside Israel. Reported victimology includes Israeli corporations, defense contractors, storage and archival service providers, and Israel-based users. Publicly attributed operations include data theft and leak campaigns against Israeli companies, compromise claims involving defense contractors, and destructive attacks using the proprietary POKYBLIGHT wiper. Cyber Toufan has also been associated with hack-and-leak activity involving sensitive schematics, personnel information, internal documents, and surveillance footage, consistent with efforts to impose reputational damage, psychological pressure, and public-trust erosion. Operationally, Cyber Toufan has been described as using relatively unsophisticated but disruptive tactics common to Iran-aligned hacktivist fronts, including broad compromise claims, retaliatory messaging, and information operations. At the same time, it has been directly linked to more consequential activity such as destructive wiper deployment, credential abuse or exploitation of weak authentication, compromise of connected devices and peripheral systems, and theft followed by public disclosure of stolen data. Reporting also places the group within a wider ecosystem that amplifies propaganda and may pause or resume operations in line with regional conflict dynamics. Cyber Toufan’s observed behavior spans initial access, credential abuse, destructive post-compromise activity, data exfiltration, and public leak operations. Its dominant pattern is politically motivated anti-Israel cyber activity aligned with Iranian strategic narratives rather than financially motivated crime.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-aligned persona observed operating through the Electronic Operations Room of Islamic Resistance Axis.
Iran-linked false-flag hacktivist operation described as part of Iran's Resistance Axis; claimed large numbers of Israeli victims during the 2023 ceasefire period.
Group that had been targeting Israel prior to the current conflict, with previously compromised resources reused in recent attacks.
Named Iranian-aligned hacktivist/proxy group expected to increase activity; framed as part of a distraction layer and alignment signal for Iranian cyber ecosystem shifts.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.