Cyber Islamic Resistance · Threat actors

Cyber Islamic Resistance is a hacktivist collective ideologically aligned with Iran, engaging in operations such as website defacements, DDoS attacks, and data exfiltration targeting Israeli and Western entities. They have claimed breaches of Israeli cybersecurity firms and academic platforms, framing their actions as part of a broader narrative of retaliation. The group has also targeted critical infrastructure, asserting access to industrial control systems and operational technology environments. Their activities are often presented as part of a coordinated cyber mobilization campaign, emphasizing psychological and reputational impacts.

The group's reported origin is Iran.

Published reports on this actor:

Source: MISP Galaxy, Malpedia.

What does a hacktivist do?

Hacktivist groups choose targets based on political and current events. Denial-of-service (DDoS) attacks, website defacements and publication of stolen data are common; announcements are made on Telegram channels.

Which defenses matter most?

Use denial-of-service protection and a content delivery network for your website and APIs.
Keep your content management system and plugins updated, and do not expose the admin panel to the internet.
Monitor announcement channels: target lists are shared before attacks.

Is your organization mentioned?

Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.

Search your domain

Threat Intelligence