Conquerors Electronic Army
Conquerors Electronic Army (CEA), also referenced in the content as operating under or alongside Cyber Islamic Resistance (CIR) / Cyber Islamic Resistance-Axis and explicitly aligning with Iranian or Axis of Resistance narratives, is described as a pro-Iranian hacktivist group primarily engaged in disruptive operations. The group is repeatedly associated with distributed denial-of-service (DDoS) activity and is identified as one of the more active nuisance-level actors in the cyber activity surrounding the 2026 Iran-Israel-U.S. conflict. The content places CEA among disruptive hacktivist groups such as Keymous+, DieNet, and NoName057(16), and notes that it was one of the three groups driving the large majority of observed activity in at least one reporting period. During the March 2-3, 2026 escalation, Conquerors Electronic Army recorded 36 distinct attack claims, trailing DieNet, Keymous Plus, and 313 Team. The group is also described as continuing low-level cyber activity without pause during the later ceasefire period. Reported targeting attributed to CEA includes Israeli companies and services infrastructure, Israeli military resources, and other Israeli targets. Specific claims in the content include a DDoS attack against t.co.il, an Israeli companies and services directory, with Check-Host verification reportedly published, and April 8 claims of DDoS attacks against Israeli targets and the U.S.-based freelancer platform Upwork. The broader reporting also places the group among pro-Iranian actors targeting e-government and regional entities during the conflict period. The content does not provide high-confidence evidence of advanced intrusion, malware development, or verified destructive capability for this actor. The directly supported characterization is that Conquerors Electronic Army is a pro-Iranian / Axis-aligned hacktivist brand focused on disruptive DDoS-style operations, propaganda-aligned targeting, and participation in coalition activity under the CIR umbrella.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Consumer Discretionary Distribution & Retail
- Health Care Equipment & Services
- Banks
- Media & Entertainment
- Public Safety
Where they target
Geographies tied to known operations.
- 🇮🇱 Israel
- 🇬🇧 United Kingdom
Tradecraft
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-aligned group conducting low-level disruptive activity during the ceasefire period, including claimed DDoS attacks against Israeli targets and the US-based Upwork platform.
Named as a pro-Iranian hacktivist group active during the March 2026 escalation, associated with attack claim activity.
Group involved in DDoS attempts against Israeli military resources during the conflict.
CIR-affiliated actor conducting multi-sector DDoS campaigns and propaganda operations against Israeli and occasional foreign civilian targets.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.