Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
🇮🇷 IR

313

Also known as313

313 Team is an Iran-aligned hacktivist group that describes itself as part of the "Cyber Islamic Resistance in Iraq." Reporting cited in the content identifies it as one of several Iran-aligned groups active in cyber campaigns affecting Gulf states, alongside DieNet, Fatimion Cyber Team, Fad Team, and ALTOUFAN TEAM. The content states these identified Iran-aligned groups are not part of the Iranian state and are described as independent actors seeking visibility and credibility. The group has been associated primarily with disruptive attack claims, especially denial-of-service activity against public-facing government and military services. One cited example is 313 Team’s claim of DoS shutdowns affecting Bahrain and Kuwaiti government and military services. However, the same reporting notes that these incidents were difficult to verify, that public reporting described only minor disruptions, and that the attacks either did not have the impact claimed by 313 Team or were later attributed to other groups. More broadly, the content characterizes early activity by Iran-aligned groups such as 313 Team as consistent with short-lived DDoS campaigns intended to overwhelm public websites rather than penetrate government systems, often coordinated via Telegram and typical of hacktivist publicity operations. During the March 2-3, 2026 escalation period, 313 Team was recorded with 42 distinct attack claims, placing it behind DieNet and Keymous Plus in activity volume. The content does not provide verified evidence of more advanced capabilities by 313 Team beyond these disruptive claims.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Government & Administration
  • Telecommunication Services
  • Banks
  • Transportation
  • Public Safety
  • Energy

Where they target

Geographies tied to known operations.

  • 🇦🇪 United Arab Emirates
  • 🇧🇭 Bahrain
  • 🇮🇱 Israel
  • 🇯🇴 Jordan
  • 🇺🇸 United States
  • 🇸🇦 Saudi Arabia
  • 🇶🇦 Qatar

Where they're from

Attributed origin per open-source reporting.

  • IR
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.