Edalat-e Ali
Edalat-e Ali is classified as hacktivist.
- Type
- Hacktivist
- Origin
- Iran
Edalat-e Ali is a hacktivist group known for disrupting Iranian state-run TV and radio transmissions during significant events, such as the Revolution Day ceremonies. They have also targeted government facilities, releasing security camera footage to expose abuses and draw attention to human rights violations. The group has used their hacks to call for protests against the Iranian regime and have displayed anti-government messages during their disruptions. Edalat-e Ali has been active in releasing sensitive information and footage to embarrass Iranian officials and highlight injustices within the country.
The group's reported origin is Iran.
Published reports on this actor:
- https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/
- https://securityaffairs.com/142172/hacktivism/iranian-state-tv-hacked.html
- https://www.chronline.com/stories/a-hacking-slugfest-between-iran-and-its-foes-sparks-fears-of-a-wider-cyberwar,281423
Source: MISP Galaxy, Malpedia.
What does a hacktivist do?
Hacktivist groups choose targets based on political and current events. Denial-of-service (DDoS) attacks, website defacements and publication of stolen data are common; announcements are made on Telegram channels.
Which defenses matter most?
- Use denial-of-service protection and a content delivery network for your website and APIs.
- Keep your content management system and plugins updated, and do not expose the admin panel to the internet.
- Monitor announcement channels: target lists are shared before attacks.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.