Loading threat actor…
Cyber Islamic Resistance is a pro-Iranian hacktivist umbrella collective within the Axis of Resistance cyber ecosystem. Also styled The Cyber Islamic Resistance, it coordinates multiple teams conducting politically motivated disruption, website defacement, reconnaissance, and data-theft operations. Its activity is aligned with Iranian regional interests, but this alignment does not establish direct control by a particular Iranian intelligence or military organization. On March 1, 2026, the collective announced a joint Electronic Operations Room and a general cyber mobilization campaign. The coordination structure brought together more than 15 groups, with participants and affiliates including 313 Team, RipperSec, Moroccan Black Cyber Army, and DieNet. Coalition membership is fluid rather than a fixed hierarchy. The collective primarily targets Israel and coordinates campaigns against Gulf states and U.S.-linked entities. Its operations include DDoS attacks, defacements, phishing, and public dissemination of stolen material, combining service disruption with propaganda amplification. Cyber Islamic Resistance collaborated with the Russian-aligned group NoName057(16) on large-scale DDoS attacks against an Israeli defense contractor and multiple municipal governments. Targeting also encompasses healthcare and health insurance organizations. Public attack announcements and coordinated coalition branding are central to its mobilization and messaging.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
25 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.