Z-Alliance
Z-Alliance is a Russian-aligned hacktivist threat group. Reporting cited in the provided content states that Z-Alliance, alongside Cyber Army of Russia Reborn, TwoNet, and the Infrastructure Destruction Squad, evolved from low-impact DDoS activity into operations involving OT/IoT reconnaissance and claimed disruptive attacks against industrial targets. The group has been associated with targeting or claiming compromises of cameras, and the content places it among actors observed targeting internet-exposed IP cameras. Separate reporting in the content also states that Z-Alliance issued a statement in Russian declaring support for Iran and readiness to conduct offensive operations during the Israel-Iran conflict, and claimed an attack against the Gan HaDarom pumping station. Based on the provided material, Z-Alliance should be understood as a Russian-aligned hacktivist actor involved in disruptive and propaganda-driven operations, with activity spanning DDoS, camera targeting, OT/IoT reconnaissance, and claimed industrial targeting.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Capital Goods
- Utilities
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russia-aligned hacktivist group involved in OT/IoT reconnaissance and disruptive industrial targeting beyond traditional DDoS activity.
Listed as a threat group that has claimed to have compromised cameras or has been observed targeting cameras.
Hacktivist group publicly supporting Iran; claims targeting of Israeli water infrastructure.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.