Loading threat actor…
Cyber Islamic Resistance is a pro-Iranian hacktivist umbrella and coordination brand within the broader Axis of Resistance cyber ecosystem. It is described as an active joint operations structure, including an “Electronic Operations Room,” used to synchronize multiple aligned groups and amplify disruptive cyber activity during periods of regional conflict. Reported affiliated or cooperating elements have included groups such as 313 Team, DieNet, Dark Storm Team, Fatimion Cyber Team, Cyber Fattah, Moroccan Black Cyber Army, RipperSec, and at times cooperation with the pro-Russian actor NoName057(16). The group is widely assessed as part of a deniable proxy layer aligned with Iranian state interests rather than a traditional standalone APT. Its operations have primarily targeted Israel and other states perceived as aligned with the United States or Israel, including Gulf countries and Jordan, with additional activity affecting U.S.-linked entities. Targeting has included government institutions, defense-related organizations, healthcare, financial services, municipal entities, and critical infrastructure. During regional escalations in 2025 and 2026, Cyber Islamic Resistance was associated with coordinated distributed denial-of-service campaigns, website defacements, phishing, reconnaissance, data theft claims, and hack-and-leak style propaganda operations. It has also been linked to claims involving CCTV exposure, building management systems, routers, and alleged OT/ICS access, including screenshots purportedly showing industrial interfaces; however, many OT/ICS-related claims were not independently verified. The actor’s main value appears to be coalition-building, rapid mobilization, propaganda amplification, and orchestration of low- to mid-sophistication disruptive operations across a broad ecosystem of aligned hacktivist brands. Reported behavior indicates use of Telegram-centric coordination, shared target lists, synchronized attack timing, and public proof-of-impact messaging. Cyber Islamic Resistance should be understood as a conflict-driven, Iran-aligned coordination umbrella that blends hacktivism, psychological operations, and disruptive cyber activity in support of broader geopolitical objectives.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
25 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-aligned proxy-layer hacktivist group participating in the broader wartime disruption and propaganda ecosystem.
Pro-Iranian umbrella group coordinating multiple hacktivist groups and reportedly working with NoName057(16) on DDoS attacks against Israeli targets.
Umbrella hacktivist coordinator directing joint operations across Gulf states and Israel through a multi-group operations room.
Early hacktivist mobilization linked to the opening cyber phase of the Iran war.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.