Loading threat actor…
Jabhat al-Nusra, also known as JN, was the official al-Qaeda branch in Syria during the early years of the Syrian civil war. The group emerged as a major Sunni jihadist faction in Syria and became central to the power struggle between al-Qaeda and the Islamic State movement after Abu Bakr al-Baghdadi attempted to subsume it into the Islamic State of Iraq and al-Sham in 2013. Jabhat al-Nusra, under Abu Muhammad al-Jawlani, rejected that move and reaffirmed allegiance to al-Qaeda leader Ayman al-Zawahiri, helping trigger the formal split between al-Qaeda and ISIS in 2014 and subsequent armed conflict between the two organizations in Syria. The organization operated primarily in Syria and was involved in insurgent warfare against the Syrian state while also competing with rival jihadist factions. It was associated with al-Qaeda’s broader strategic line and was publicly defended by prominent al-Qaeda-linked ideologues and figures during disputes with ISIS and defectors from other jihadist organizations. Reporting tied the group to major battlefield activity in Syria, including operations in Idlib. High-confidence information in the available material supports Jabhat al-Nusra’s role as an al-Qaeda-aligned militant and terrorist organization active in Syria, but does not provide sufficient direct detail to attribute a broader set of specific cyber capabilities, ransomware activity, or a clearly documented industry-targeting profile.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An al-Qaeda affiliate whose representatives publicly denounced ISIS and the defections from the Islamic Emirate of the Caucasus.
Referenced in the timeline as taking Idlib in Syria in connection with water-related conflict dynamics around the Orontes basin.
Al-Qaeda’s official branch in Syria, positioned against ISIS and favoring coalition-building, gradualist governance, and cooperation with other Islamist factions while fighting the Assad regime.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.