Loading threat actor…
Indian Cyber Force (ICF) is an India-based hacktivist group active since at least 2022 that conducts politically motivated cyber operations aligned with pro-India causes and, in some campaigns, pro-Israel positions. The group is commonly referred to as Indian Cyber Force or ICF. It has been associated with retaliatory and solidarity-driven campaigns tied to regional crises and diplomatic disputes involving India, including operations connected to Pakistan, Palestine, Qatar, the Maldives, Bangladesh, Canada, China, and Iran. Pakistan is the most consistently reported target. ICF’s activity is characteristic of hacktivist operations focused on visibility, disruption, and propaganda impact. Reported tactics include distributed denial-of-service attacks, website defacement, unauthorized access to exposed systems, data theft and public leaking of stolen information, and compromises of internet-connected cameras and other networked devices. Across multiple campaigns, the group has publicly claimed breaches of government, banking, university, police, municipal, and other institutional systems, as well as compromises of surveillance infrastructure. It has also been described as active on social media and messaging platforms, where it publicizes operations, amplifies political messaging, and releases alleged stolen data. During the 2025 India-Pakistan crisis and Operation Sindoor-related activity, Indian Cyber Force was identified among the most active pro-India hacktivist groups. It claimed intrusions and disruptive operations against Pakistani government and institutional targets, including tax, banking, university, police, and other administrative systems, and also claimed large-scale compromises of CCTV infrastructure in Pakistan. In earlier campaigns, ICF was reported targeting Palestinian entities after the October 2023 Hamas attack on Israel, including attacks affecting Hamas-linked and Palestinian financial, telecommunications, and government-related services. It also claimed cyberattacks against Qatari targets in response to the sentencing of former Indian Navy officers, and participated in anti-Canada activity during diplomatic tensions over allegations tied to the killing of Hardeep Singh Nijjar. Additional reported operations include attacks against Bangladeshi and Maldivian public-sector targets. The group is widely characterized as hacktivist rather than a formally acknowledged state organ. Some reporting has speculated about possible links between a portion of its membership and Indian government-linked entities, while the group has publicly described itself as non-governmental. High-confidence reporting supports describing Indian Cyber Force as an Indian hacktivist actor engaged in politically motivated offensive cyber activity, especially disruptive attacks, defacements, unauthorized access, and data exposure operations against states and entities perceived as hostile to Indian interests.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pro-Israel hacktivist group targeting pro-Iran channels and defacing Pakistani and Iranian websites in solidarity operations.
Pro-India hacktivist group conducting retaliatory cyberattacks against Pakistani targets, including DDoS and claimed compromises of government and institutional websites.
Pro-India hacktivist group that claimed breaches of Pakistani government, banking, university, and surveillance systems during Operation Sindoor.
Pro-India (and described as pro-Israel) hacktivist collective conducting politically motivated operations including DDoS, website defacements, and data leaks/breaches; also claims compromises of IP camera networks and other networked devices, often in response to geopolitical events involving India (e.g., Canada diplomatic row, Israel-Hamas conflict, India–Maldives row, India–Pakistan tensions).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.