CyberToufan
CyberToufan is an anti-Israel hacktivist group with unknown affiliation. Reporting in the provided content describes it as targeting Israeli corporations and organizations through data theft, leak operations, and destructive attacks. It is specifically described as having hacked the Israeli storage company Signature-it, leaking data from multiple Israeli organizations, and as having conducted wiper attacks against multiple organizations in Israel. The group is also characterized as having targeted Israeli corporations with data theft and leak operations. In the broader context of cyber activity around the Gaza conflict and later regional escalation, CyberToufan is presented as part of the anti-Israel hacktivist ecosystem rather than a confirmed nation-state actor. No additional aliases or sub-groups beyond the name CyberToufan are directly provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇮🇱 Israel
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Group that had been targeting Israel prior to the current conflict, with previously compromised resources reused in recent attacks.
Data theft and leak operations targeting Israeli corporations; affiliation not specified in the content.
Iran-aligned destructive operations using wiper attacks against Israeli organizations.
CyberToufan is an anti-Israel hacktivist group conducting data breaches and leaks against Israeli organizations, motivated by political ideology.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.