Loading threat actor…
Fatimion Cyber Team is a pro-Iranian, Iran-aligned hacktivist group active in the broader Middle East conflict ecosystem and associated with the so-called Islamic Cyber Resistance / Cyber Isnaad Front milieu. It is regularly listed alongside groups such as 313 Team, DieNet, Cyber Fattah, FAD Team, AL Toufan, Liwaa Mohammad, Gaza313, and related Iraqi militia-aligned cyber personas. Reporting places the group within an Iraq-Iran cyber corridor, with apparent coordination from Iraqi territory and ideological alignment with the Axis of Resistance and Iranian strategic objectives. Fatimion Cyber Team has been described as Iranian-backed or affiliated rather than a formally acknowledged state unit. The group has participated in coordinated campaigns against Israeli, Gulf, and Western targets, including attacks on Israeli Air Force and government websites. Its observed activity includes reconnaissance, distributed denial-of-service operations, website defacement, and data theft. Broader campaign reporting also links Iran-aligned clusters including Fatimion Cyber Team to disruptive and destructive operations intended to erase data, disrupt services, and create uncertainty for private-sector and public targets. During periods of regional military escalation, the group has appeared in synchronized operations with other Iran-aligned hacktivist actors, suggesting shared targeting, timing, and amplification behavior across messaging channels. Fatimion Cyber Team is best understood as part of a deniable proxy-style ecosystem that blends ideological hacktivism with coordinated regional cyber operations. Its activity aligns primarily with geopolitical confrontation involving Israel and Iran’s regional adversaries, and it has been associated with campaigns affecting government entities, military-related targets, and private-sector organizations. Known aliases include Fatimion and fatimion_cyber.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-aligned hacktivist group involved in regional cyber activity targeting Gulf states, with operations centered on disruption claims and coordinated online amplification.
Threat group cited as targeting private-sector organizations with destructive and disruptive attacks intended to erase data, disrupt services, and create uncertainty.
Iranian-aligned hacktivist group involved in coordinated cyber operations during the 2026 Iran conflict against US, Israeli, and GCC targets.
Iranian-aligned hacktivist group identified as a key player in the escalation, involved in reconnaissance, DDoS campaigns, website defacements, and data theft.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.