Loading threat actor…
FAD Team is a pro-Iran, hacktivist-style threat actor associated with the broader Islamic Cyber Resistance and Cyber Isnaad Front ecosystem. Reporting places the group within an Iraq-Iran cyber corridor alongside entities such as 313 Team, Fatimion Cyber Team, AL Toufan, Liwaa Mohammad, AL_Safwa313, Al Safwa, Unit 313, and Gaza313. The group appears to operate with ideological alignment to the Axis of Resistance and has been described as coordinating or amplifying activity with other Iran-aligned personas, while remaining distinct from confirmed Iranian state APT units. FAD Team has been linked to disruptive and opportunistic operations conducted during periods of regional escalation involving Iran, Israel, and Gulf states. Its observed activity includes low-level distributed denial-of-service attacks, website defacements, phishing campaigns, SQL injection, and publicized data leaks. The group has claimed attacks against organizations in the Middle East, Israel, the United States, and elsewhere, including government-related entities, educational institutions, and military-themed or defense-adjacent targets. Broader reporting also places it among Iran-aligned groups targeting critical infrastructure, government services, and financial institutions in Israel and Gulf countries hosting U.S. assets. Operationally, FAD Team fits the pattern of a deniable proxy or aligned hacktivist actor that emphasizes publicity, retaliation narratives, and coalition signaling over sophisticated, high-confidence state tradecraft. It has been observed participating in campaigns where multiple pro-Iran and sometimes pro-Russian groups amplify one another’s claims across messaging channels. The group’s behavior is consistent with disruptive operations, credential-focused phishing, data theft and leakage, and basic intrusion techniques used to generate visibility and psychological impact rather than sustained covert access. Known aliases and closely associated naming include FAD Team and Fad Team.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a known Iranian group used for comparison in attribution analysis; the content does not link the observed campaign to FAD Team.
Referenced as a known Iranian group for comparison of infrastructure and tradecraft; the report indicates the observed campaign does not match these patterns.
Iran-aligned group active in the campaign ecosystem, contributing to hacktivist disruption activity and coordinated claim amplification targeting Gulf-aligned states.
Hacktivist group named as participating in disruptive operations related to the conflict.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.