Loading threat actor…
Inteid is a pro-Russian and pro-Iran-aligned hacktivist threat actor that has appeared both as an independent brand and as a member of larger cooperative alliances. It has been identified as part of the Russian Legion coalition alongside Cardinal, The White Pulse, and Russian Partizan during the 2026 campaign against Denmark, and it has also been observed collaborating with groups such as Keymous+ in anti-Israel operations during the 2025 Iran-Israel cyber escalation. The actor’s activity is consistent with politically motivated disruptive operations tied to geopolitical events rather than financially motivated intrusion campaigns. Inteid is associated primarily with distributed denial-of-service operations and publicized disruptive attacks against online services. Reported activity includes preliminary and follow-on attacks against Danish public-sector services during OpDenmark, including healthcare-related services, as well as claimed attacks against Israeli news, telecommunications, and medical organizations. Its operations fit the broader hacktivist pattern of combining service disruption with propaganda and psychological pressure through public announcements, alliance-building, and amplification on Telegram. Observed tradecraft is centered on disruption and influence rather than advanced intrusion. High-confidence reporting links Inteid to DDoS activity, coordinated campaign participation, target selection aligned with geopolitical narratives, and public collaboration with ideologically aligned groups. In the Denmark campaign, the actor operated within a state-aligned but not necessarily state-directed ecosystem supporting Russian geopolitical objectives. In the Middle East context, Inteid was among the groups publicly coordinating anti-Israel cyber activity with other pro-Iranian and pro-Palestinian hacktivist actors. Claimed targeting spans public services, healthcare, media, and telecommunications.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Member of Russian Legion linked to a recent DDoS attack against Denmark’s health portal and involved in public claims of attacks on Danish organizations.
Russian Legion member credited with preliminary DDoS activity against Denmark’s sundhed.dk, demonstrating capability to disrupt healthcare-related online services as part of the broader “OpDenmark” campaign.
Pro-Iranian/pro-Palestinian hacktivist group participating in coordinated attacks against Israel and its allies.
Hacktivist actor coordinating with Keymous+; claims attacks against Israeli financial and transportation targets.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.