Cyber Fattah
Cyber Fattah is a pro-Iranian hacktivist group that describes itself as an "Iranian cyber team" and is repeatedly characterized in the reporting as Iranian-backed, Iran-aligned, or affiliated with Iran’s broader proxy cyber ecosystem. The content places it among hacktivist and operational groups activated in support of Iranian objectives during the June 2025 Iran-Israel conflict and after the February 2026 U.S.-Israel strikes on Iran. It is also described in one source as a Palestinian-linked cell. The reporting links Cyber Fattah to Iran’s layered cyber proxy model alongside groups such as Fatimion Cyber Team, Cyber Islamic Resistance, DieNet, and 313 Team, and notes that its branding appears designed to signal ideological allegiance to Tehran’s military-industrial narrative. The group is also noted as collaborating with regional actors such as 313 Team. Reported activity attributed to Cyber Fattah includes reconnaissance, DDoS campaigns, website defacements, data theft, and data dumps. During the June 2025 conflict, it was cited as participating in reconnaissance, DDoS, defacement, and data theft operations coordinated with military developments on the ground. The group has been described as targeting Israeli and Western web resources and government agencies, educational institutions in Israel, and publicly exposed IoT devices by scanning Israeli-based network ranges. It was also cited as claiming responsibility for data dumps including targeting Israel’s Channel 13 News. A specifically reported incident involved the alleged publication of thousands of personal records linked to athletes and visitors of the Saudi Games. According to the content, the breach was announced on Telegram on June 22, 2025 and shared as SQL database dumps. Resecurity assessed the intrusion as unauthorized access to phpMyAdmin tied to the Saudi Games 2024 official website, with leaked material reportedly including IT staff credentials, government email addresses, passports or ID cards, bank statements, medical forms, and other scanned sensitive documents. The reporting frames this incident as part of anti-U.S., anti-Israel, and anti-Saudi propaganda. Cyber Fattah uses Telegram as a key platform for claiming attacks, broadcasting narratives, and rallying participants, including announcing DDoS targets. One report states the group announced planned attacks would follow after it finished "collecting specific resources," and another notes that on March 22 it forwarded a post from APT IRAN claiming a proof of concept for the alleged Lockheed Martin breach. The content also states that at least 60 hacktivist groups, including Cyber Fattah, were activated by Iran after the U.S.-Israel attacks. Known alias in the provided content: Cyber Fattah Team.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇮🇱 Israel
Where they're from
Attributed origin per open-source reporting.
- IR
Tradecraft
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated vulnerabilities
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
The pro-Iranian actors were also targeting popular Hikvision and Dahua cameras with a number of authentication and command-related vulnerabilities. The bugs they use include CVE-2017-7921, CVE-2021-36260, and CVE-2023-6895, and CVE-2025-34067 for Hikivision; and CVE-2021-33044 in the case of Dahua. Patches for all vulnerabilities are available now.
The pro-Iranian actors were also targeting popular Hikvision and Dahua cameras with a number of authentication and command-related vulnerabilities. The bugs they use include CVE-2017-7921, CVE-2021-36260, and CVE-2023-6895, and CVE-2025-34067 for Hikivision; and CVE-2021-33044 in the case of Dahua. Patches for all vulnerabilities are available now.
The pro-Iranian actors were also targeting popular Hikvision and Dahua cameras with a number of authentication and command-related vulnerabilities. The bugs they use include CVE-2017-7921, CVE-2021-36260, and CVE-2023-6895, and CVE-2025-34067 for Hikivision; and CVE-2021-33044 in the case of Dahua. Patches for all vulnerabilities are available now.
The pro-Iranian actors were also targeting popular Hikvision and Dahua cameras with a number of authentication and command-related vulnerabilities. The bugs they use include CVE-2017-7921, CVE-2021-36260, and CVE-2023-6895, and CVE-2025-34067 for Hikivision; and CVE-2021-33044 in the case of Dahua. Patches for all vulnerabilities are available now.
The pro-Iranian actors were also targeting popular Hikvision and Dahua cameras with a number of authentication and command-related vulnerabilities. The bugs they use include CVE-2017-7921, CVE-2021-36260, and CVE-2023-6895, and CVE-2025-34067 for Hikivision; and CVE-2021-33044 in the case of Dahua. Patches for all vulnerabilities are available now.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist group described as activated by Iran following the U.S.-Israel attacks.
Iranian-aligned hacktivist group participating in coordinated cyber activity during the 2026 Iran conflict.
Pro-Iranian hacktivist group targeting Israeli educational institutions and exposed IoT devices, including surveillance camera infrastructure.
Actor engaged in reconnaissance-stage messaging and amplification of APT IRAN breach claims, including Lockheed Martin-related PoC material.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.