Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to threat actors

Conquerors Electronic Army

Also known asConquerors Electronic Army

Conquerors Electronic Army (CEA), also referenced in the content as operating under or alongside Cyber Islamic Resistance (CIR) / Cyber Islamic Resistance-Axis and explicitly aligning with Iranian or Axis of Resistance narratives, is described as a pro-Iranian hacktivist group primarily engaged in disruptive operations. The group is repeatedly associated with distributed denial-of-service (DDoS) activity and is identified as one of the more active nuisance-level actors in the cyber activity surrounding the 2026 Iran-Israel-U.S. conflict. The content places CEA among disruptive hacktivist groups such as Keymous+, DieNet, and NoName057(16), and notes that it was one of the three groups driving the large majority of observed activity in at least one reporting period. During the March 2-3, 2026 escalation, Conquerors Electronic Army recorded 36 distinct attack claims, trailing DieNet, Keymous Plus, and 313 Team. The group is also described as continuing low-level cyber activity without pause during the later ceasefire period. Reported targeting attributed to CEA includes Israeli companies and services infrastructure, Israeli military resources, and other Israeli targets. Specific claims in the content include a DDoS attack against t.co.il, an Israeli companies and services directory, with Check-Host verification reportedly published, and April 8 claims of DDoS attacks against Israeli targets and the U.S.-based freelancer platform Upwork. The broader reporting also places the group among pro-Iranian actors targeting e-government and regional entities during the conflict period. The content does not provide high-confidence evidence of advanced intrusion, malware development, or verified destructive capability for this actor. The directly supported characterization is that Conquerors Electronic Army is a pro-Iranian / Axis-aligned hacktivist brand focused on disruptive DDoS-style operations, propaganda-aligned targeting, and participation in coalition activity under the CIR umbrella.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Consumer Discretionary Distribution & Retail
  • Health Care Equipment & Services
  • Banks
  • Media & Entertainment
  • Public Safety

Where they target

Geographies tied to known operations.

  • 🇮🇱 Israel
  • 🇬🇧 United Kingdom
MITRE ATT&CK

Tradecraft

3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

1 of 15 tactics4 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0040
Impact
3 techniques
T1491
Defacement
T1491.001
Internal Defacement
T1498×4
Network Denial of Service
T1499
Endpoint Denial of Service
IOCS

Observables

2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping3

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables2

Domains, IPs, and hashes tied to this actor, refreshed continuously.