Loading threat actor…
RipperSec is a hacktivist collective aligned with pro-Palestinian and broader Muslim-identity messaging that primarily conducts disruptive and propaganda-oriented operations. The group is best known for distributed denial-of-service attacks, website defacements, and public campaign messaging delivered through Telegram-centric channels. It has repeatedly framed its activity as retaliation against states or organizations it perceives as supporting Israel or acting against Palestinian interests, and it has also participated in broader conflict-driven campaigns targeting India and other countries. RipperSec has been described as having Malaysian roots and as operating within a wider Southeast Asian ecosystem, though some reporting has also associated it with Bangladesh; the strongest recurring attribution supports Malaysia. The group has also used or been associated with the alias Cyb3rDrag0nzz, and has appeared in coalition settings alongside other resistance-branded hacktivist groups. It formally integrated into the Cyber Islamic Resistance or Islamic Cyber Resistance electronic operations ecosystem, a pro-Iran-aligned umbrella that coordinates multiple hacktivist teams for synchronized disruptive campaigns. Within that ecosystem, RipperSec has been linked to joint operations and amplification with actors such as 313 Team, Cyber Fattah, Fatimiyoun/FAD Team, Conquerors Electronic Army, DieNet, Keymous+, and Moroccan Black Cyber Army. Operationally, RipperSec relies on high-visibility, low-to-moderate sophistication tactics. Its most consistently observed behaviors are DDoS attacks and defacements against government and public-facing targets, often accompanied by slogans, warnings, and ideological statements. Reporting also links the group to repeated targeting of Israeli government bodies and other Israeli entities, as well as campaigns against Indian targets during periods of India-Pakistan tension. More recent activity expanded to South Korean government and private-sector entities, justified by the group through accusations that South Korea supported Israeli military operations. Additional reporting indicates activity against UK organizations and against EU member-state sectors including public administration, media and entertainment, and transport, with stated interest in operational technology targets. RipperSec’s communications infrastructure is heavily centered on Telegram, where it has repeatedly rebranded, migrated channels, maintained backup pages, warned about impersonators, and used public discussion spaces for onboarding and visibility. The group has promoted a DDoS tool called MegaMedusa and appears to operate within a loose ecosystem of operators, supporters, and tool developers rather than as a tightly centralized organization. Available reporting indicates donation-based support and public fundraising rather than ransomware monetization or systematic victim extortion. The actor’s dominant profile is ideological hacktivism focused on disruption, propaganda, and coalition-based mobilization rather than stealthy long-term intrusion. Although some reporting places RipperSec in proximity to pro-Iran and, separately, pro-Russia ecosystems, the most consistent high-confidence characterization is a pro-Palestinian hacktivist actor that uses DDoS, defacement, and public messaging to support geopolitical causes.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
14 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as part of the broader pro-Iran coalition aligned with 313 Team in resistance-branded cyber activity.
Malaysian group referenced as operating separate infrastructure distinct from Keymous+ and EliteStress.
Southeast Asian hacktivist group integrated into CIR operations, conducting DDoS and website defacement against Israeli targets.
Hacktivist group integrated into the Electronic Operations Room during the 2026 escalation.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.