Indra

Indra is a threat actor/hacktivist alias that has been linked in the provided reporting to disruptive operations against Iranian transportation and fuel infrastructure and to data-theft activity against commercial organizations. Check Point attributed a July 2021 Iranian rail-system attack to a group calling itself Indra; the same reporting says the group was named after the Hindu god of war, had previously targeted firms in Syria, and claimed to be an anti-government partisan resistance group. Related reporting also describes Indra as an anti-Iranian regime hacktivist group. The rail attack was later cited as resembling the October 2021 cyberattack on Iran’s fuel distribution system, including use of the message "cyberattack 64411," although separate reporting in the provided content says the fuel attack was claimed by Predatory Sparrow. In 2025–2026 reporting, an actor using the alias "Indra" claimed responsibility on BreachForums for the ManoMano breach, alleging theft of approximately 43 GB of data including 37.8 million user records, 935,000 support tickets, and 13,500 attachments. For the ManoMano incident, the reported access path was compromise of a third-party customer-support subcontractor’s Zendesk account, with no evidence of malware deployment, software-vulnerability exploitation, or compromise of ManoMano’s core infrastructure. ATT&CK techniques explicitly mapped in the provided content for that intrusion include Valid Accounts (T1078), External Remote Services (T1133), Data from Information Repositories (T1213), Exfiltration Over Web Service (T1567.002), and Data Leak (T1537). Known alias in the provided content: Indra.