OverFlame
OverFlame is a hacktivist group referenced in the reporting as part of a broader pro-Iranian/pro-Palestinian cyber ecosystem active during the 2026 Iran-Israel conflict. The group is described as participating in coordinated disruptive campaigns targeting GCC critical infrastructure portals and governmental systems, and as being active in cyber operations related to the conflict alongside groups such as Handala Hack Team and DieNet. Reporting also states that DieNet shares DDoS-as-a-service infrastructure with OverFlame and DenBots Proof, based on attack source analysis, indicating overlap in operational infrastructure for network-disruption activity. Separately, Forescout reporting cited in the content says the pro-Russian hacktivist group TwoNet claimed ties or affiliation with OverFlame and CyberTroops, and that Russia-based hacktivist group NoName057(16) / S16 was observed partnering with OverFlame to target energy facilities. Based on the provided content, OverFlame is associated with disruptive operations, especially DDoS-style activity and targeting of government and critical infrastructure entities; no higher-confidence malware, intrusion, or destructive ICS capabilities are directly established in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist or disruptive actor sharing DDoS-as-a-service infrastructure with DieNet.
Hacktivist/disruptive activity targeting GCC critical infrastructure portals and government systems.
Hacktivist group involved in coordinated disruptive campaigns against GCC critical infrastructure portals and government systems.
Mentioned only as an entity that TwoNet claims ties to; no specific operations, tooling, victims, or TTPs are described in the provided content.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.