Loading threat actor…
DieNet is a pro-Iranian, pro-Palestinian hacktivist brand that emerged on Telegram in March 2025 and became one of the most prolific disruptive actors in the 2026 Iran-Israel conflict. It operates primarily as a high-volume distributed denial-of-service actor and as a force multiplier for a broader Iran-aligned hacktivist ecosystem, including participation in the Electronic Operations Room alongside groups such as 313 Team, Cyber Islamic Resistance, APT IRAN, Keymous+, Dark Storm Team, FAD Team, and Sylhet Gang-SG. Multiple assessments characterize DieNet as a central node in coalition activity, supplying DDoS tooling, structured target lists, and attack verification workflows for allied groups. DieNet’s core tradecraft is centered on disruptive operations rather than stealthy intrusion. Its most consistently corroborated activity involves politically timed DDoS campaigns against government, financial, telecommunications, transportation, utility, and other public-facing services. During the late February to early March 2026 escalation, DieNet and Keymous+ were assessed as the dominant drivers of hacktivist attack volume, together accounting for a large share of observed claims. DieNet was repeatedly identified as a primary volume driver for synchronized attacks across Israel and Gulf Cooperation Council states, especially Kuwait, Bahrain, Jordan, Saudi Arabia, and the United Arab Emirates. It has also threatened or claimed attacks against U.S. targets and other states perceived as aligned with Israel or the United States. The group’s operational model relies heavily on rented DDoS-as-a-service infrastructure and common flooding and amplification techniques rather than bespoke malware development. Reporting also describes DieNet as a propaganda-oriented organization that amplifies symbolic targeting, public claims, and coalition messaging to maximize psychological impact. Some analyses portray it as structurally resembling a franchise, with a core leadership circle supported by a wider ring of opportunistic operators and allied channels. DieNet has made broader claims involving data theft, ransomware, and operational-technology or industrial-control-system access, including imagery purporting to show industrial interfaces. However, these intrusion and OT-related claims are repeatedly assessed as unverified, exaggerated, or primarily intended for intimidation and narrative effect. The actor’s highest-confidence capability remains disruptive denial-of-service operations and propaganda amplification in support of Iran-aligned geopolitical objectives.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Contributes DDoS activity and propaganda amplification; specifically noted for some of the highest-volume DDoS campaigns of the conflict.
Hacktivist actor in the pro-Iran/Axis-aligned ecosystem contributing high attack volume, rhetoric, target lists, and claims amplification during crisis-driven campaigns.
Iran-aligned persona operating through the Electronic Operations Room of Islamic Resistance Axis; specifically claimed DDoS attacks against airports and banks.
Hacktivist support network and toolkit provider supplying DDoS capability, target lists, and automated verification for Gulf-focused operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.