Pro-Iran Hacktivist Networks Mobilize During Kinetic Conflict, Leveraging Common Tools
Pro-Iran hacktivist groups are increasingly coordinating during geopolitical conflicts, utilizing readily available infostealers and DDoS-for-hire services to exert psychological pressure and disrupt targets.
The current geopolitical tensions between the United States and Iran have highlighted a significant evolution in cyber warfare tactics, with pro-Iran hacktivist networks actively mobilizing during kinetic conflicts. Following military actions against Iran in early 2026, a surge in cyber attacks targeting U.S. and allied entities has been observed. These campaigns demonstrate a coordinated effort by state-aligned actors to leverage the cyber domain for asymmetric warfare and to project influence.
A prominent example of this mobilization is the March 2026 attack on Stryker Corporation, a U.S. medical device company. The threat actor Handala, reportedly linked to Iran's Ministry of Intelligence and Security (MOIS), exploited common infostealer malware to gain access to administrator accounts. From there, Handala utilized Microsoft's InTune management function to issue remote wipe commands across Stryker's global network, impacting over 200,000 devices in 79 countries. Handala also claimed responsibility for a separate incident involving the alleged hacking and leaking of FBI Director Kash Patel's personal emails.
Another significant campaign occurred in May 2026 when the Islamic Cyber Resistance (also known as 313 Team), an Iraqi resistance-branded group with pro-Iranian affiliations, targeted Canonical and Ubuntu infrastructure. The group claimed to employ a DDoS-for-hire service capable of delivering attacks exceeding 3.5 terabits per second. This attack disrupted official websites and Ubuntu's security API, hindering user access to critical updates and installations. The campaign was accompanied by an extortion demand, threatening continued disruption unless a ransom was paid.
The use of commercialized DDoS platforms like "Beamed" is a key enabler for these groups, allowing actors with limited technical expertise to launch highly disruptive attacks. By targeting services crucial for enterprise and cloud environments, these campaigns generate outsized operational friction and visibility. The coordination among these various hacktivist entities, often operating under the banner of resistance or nationalistic sentiment, amplifies their impact.
These groups, including Handala and 313 Team, are part of a broader, loosely knit coalition that includes nationalist actors, cyber militias, and state-adjacent proxy influence networks. They coordinate primarily through Telegram, where they share target lists, exchange DDoS-for-hire tools, and amplify each other's disruption claims. This collective action transforms relatively low-cost cyber disruptions into a potent form of wartime psychological pressure, aiming to demoralize adversaries and demonstrate resolve.
While some actors focus on direct disruption like DDoS attacks or data wiping, others contribute to the coalition's objectives through different means. Groups like Fatimiyoun/FAD Team and Cyber Isnaad Front focus on psychological warfare by publishing target lists and issuing threats. Cyber Jihad Movement (CJM) plays a role in recruitment and propaganda amplification, calling for "global cyber jihad" against perceived enemies. Evil Markhors specializes in credential harvesting and reconnaissance, identifying exposed systems for exploitation.
Defending against this evolving threat landscape requires a multi-faceted approach. Organizations must focus on robust DDoS readiness, continuous monitoring for leaked credentials and executive doxxing, and establishing rapid response and communication procedures. It is crucial for defenders to critically assess claims made on platforms like Telegram, distinguishing between mere assertions and proven breaches, and to understand that even exaggerated claims can contribute to psychological pressure and alert fatigue.
The current conflict serves as a stark reminder that the cyber domain is an integral component of modern geopolitical strategy. The ability of pro-Iran hacktivist networks to quickly mobilize, leverage accessible tools, and coordinate their efforts underscores the need for continuous vigilance and adaptive defense strategies in the face of persistent, ideologically motivated cyber threats.