Loading threat actor…
Evil Markhors is a pro-Iran-aligned threat actor operating within a broader ecosystem of hacktivist, proxy, and state-adjacent cyber groups active during periods of regional escalation involving Iran. The actor is associated with access-enablement activity rather than high-visibility destructive operations, and is characterized primarily by credential harvesting, reconnaissance, and discovery of exposed systems. Within the wider coalition, this role can improve the effectiveness of other actors by identifying weak internet-facing assets and enabling credential reuse or follow-on intrusion opportunities. Evil Markhors has been identified alongside other Iran-aligned groups including Handala Hack, 313 Team, Cyber Islamic Resistance, Dark Storm Team, FAD Team, APT Iran, Sylhet Gang, and DieNet. This ecosystem is marked by loose coordination, rapid mobilization, and heavy use of propaganda and claim amplification, often through Telegram-based channels. Common coalition tradecraft includes DDoS activity, website defacement, credential abuse, recycled breach claims, intimidation, and symbolic targeting, but Evil Markhors is specifically noted for reconnaissance-oriented and credential-focused functions rather than ransomware or advanced intrusion tradecraft. During the 2026 Middle East escalation following U.S. and Israeli strikes on Iran, pro-Iranian and state-aligned actors including Evil Markhors were reported targeting critical infrastructure, government services, and financial institutions in Israel and several Gulf states hosting U.S. assets. The actor’s observed role suggests support to broader disruptive campaigns by helping identify exposed systems and facilitating access through harvested or reused credentials. Available information supports assessment of a primarily geopolitical and anti-Western, anti-Israeli alignment consistent with the wider pro-Iran cyber mobilization network.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Supports the coalition through credential harvesting, reconnaissance, and exposed-system discovery.
Reconnaissance and credential-focused actor whose access-enablement supports broader coalition effectiveness.
Hacktivist group named as participating in disruptive operations related to the conflict.
Claimed responsibility for operations targeting Israeli and Gulf interests, primarily focusing on critical infrastructure, government services, and financial institutions.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.