Loading threat actor…
Cyber Support Front is a pro-Iran hacktivist persona that emerged or re-engaged during the regional escalation following the February 2026 U.S. and Israeli strikes on Iran. It has been observed alongside other Iran-aligned personas including Cyber Toufan, Iranian Avenger, APTIran, Handala Hack Team, and Cyb3r Drag0nz, and has been associated with the broader online ecosystem referred to as the Electronic Operations Room of Islamic Resistance Axis. The group is assessed as part of a wave of low-sophistication, influence-heavy activity rather than a highly capable state-directed intrusion set. Reported behavior attributed to this cluster has centered on disruptive and propagandistic operations such as website defacements, distributed denial-of-service attacks, doxxing, leak claims, and broad retaliatory messaging. Activity has also included amplification of unverified compromise claims and misinformation related to Israeli organizations and infrastructure. Available reporting characterizes Cyber Support Front and similar emerging or reactivated personas as relying primarily on unsophisticated tactics, embellished claims, and narrative amplification, with limited evidence of materially significant operational impact. Targeting has been tied principally to Israeli interests in the context of the conflict. Broader risk reporting around the same campaign environment also warned that U.S. organizations and entities in Gulf Cooperation Council states could face elevated reprisal risk from Iran-aligned cyber activity, but specific high-confidence targeting by Cyber Support Front beyond Israel is not established. The actor is best understood as an Iran-aligned hacktivist brand operating in support of retaliatory messaging and disruptive nuisance operations, with a dominant political and ideological orientation rather than a financially motivated or technically advanced profile.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-aligned persona observed operating through the Electronic Operations Room of Islamic Resistance Axis.
Pro-Iran hacktivist group that re-engaged or emerged during the conflict; associated generally with misinformation, incitement, and low-sophistication activity.
Emerging or reactivated pro-Iran group engaged mainly in unsophisticated tactics, embellished claims, and retaliatory messaging amplification.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.