Fatimiyoun Electronic Team
Fatimiyoun Electronic Team is an Iran-aligned/pro-Iranian cyber actor referenced in reporting on expected Iranian cyber retaliation amid regional escalation. The actor is described as being linked to the Fatimiyoun Brigade and operating via Afghanistan- or Pakistan-based networks. In the cited reporting, the group is assessed as attempting to deploy destructive wiper malware against Western financial services and energy firms. The actor is further described as using custom wiper malware similar to Shamoon variants, employing botnets, and delivering backdoors including a tool referred to as “Tickler.” Known alias in the provided content: “fatimiyoun_electronic_team” (same name).
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Energy
- Banks
- Financial Services
- Insurance
Tradecraft
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iran-aligned proxy/hacktivist group linked to the Fatimiyoun Brigade; described using wipers, DDoS botnets, and social engineering/phishing to deliver persistence backdoors; claims activity against Western targets.
Actor attempting to deploy wiper malware against Western financial services and energy sector targets.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.