Loading threat actor…
Katiba Hanifa is a Jama’at Nusrat al-Islam wal-Muslimin (JNIM)-affiliated armed group operating primarily in eastern and southeastern Burkina Faso and in neighboring Niger. The group is led by Abou Hanifa, also known as Oumarou, and forms part of JNIM’s broader expansion from Mali into Burkina Faso through locally embedded affiliated factions. Within that structure, Katiba Hanifa is one of the Burkinabè theater groups associated with JNIM’s flexible cross-border command model, which combines military and religious authority across the Sahel. Katiba Hanifa has been linked to insurgent violence against civilians in Burkina Faso. Its leadership has been identified for possible command responsibility in killings of civilians in the country’s eastern region in 2025. As a JNIM-affiliated formation, it is associated with the wider JNIM pattern of coercive territorial control, attacks on civilians, abductions, siege tactics, use of improvised explosive devices, and destruction of civilian infrastructure. JNIM networks in Burkina Faso have also been tied to cross-border militant operations and to campaigns intended to punish communities, displace civilians, and consolidate insurgent influence. Katiba Hanifa should be understood as a regional jihadist armed group embedded in the JNIM ecosystem rather than as an independent cyber threat actor. Available information supports a terrorism and insurgency profile centered on violent control of territory and attacks on civilian populations, with no direct evidence here of ransomware, extortion, or cyber intrusion tradecraft.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
JNIM-affiliated armed group operating mostly in the Niger region and southeastern Burkina Faso; implicated in killings of civilians in Diapaga in May 2025.
JNIM-affiliated armed group operating predominantly in southeastern Burkina Faso. The content presents it as one of the Burkinabè groups integrated into JNIM while retaining some identity.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.