Loading threat actor…
Red Wolf Cyber is a hacktivist group referenced in reporting on cyber activity surrounding India’s Operation Sindoor and the June 2025 Iran-Israel cyber conflict. In the provided content, it is identified as a pro-Pakistan or anti-India cyber group active during Operation Sindoor, alongside groups such as APT36 (Transparent Tribe), Team Insane PK, SideCopy, AnonSec, Keymous+, Mr Hamza, Anonymous VNLBN, Arabian Hosts, Islamic Hacker Army, Sylhet Gang, and Vulture. The content also states that Red Wolf Cyber conducted infrastructure attacks on the Israeli Ministry of Defense. More broadly, the surrounding reporting describes hacktivist activity in these conflicts as commonly involving DDoS attacks, website defacement, data breaches, spear phishing, ransomware, social engineering, and in some cases attacks against critical infrastructure, although the specific techniques used by Red Wolf Cyber beyond the cited infrastructure attack are not detailed in the content. Based on the provided material, Red Wolf Cyber should be characterized as a politically motivated hacktivist actor; no high-confidence nation-state attribution is directly stated.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Focuses on attacking Israeli defense infrastructure.
Named as a pro-Pakistan cyber group attempting to breach India's cyberspace during Operation Sindoor.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.