Loading story…
The Kurdish hacktivist group Hezi Rash has rapidly emerged as a significant threat in the hacktivist landscape, orchestrating nearly 350 distributed denial-of-service (DDoS) attacks worldwide between August and October. According to Check Point researchers, Hezi Rash has been more active than other hacktivist groups during this period, with almost a quarter of its attacks targeting Japanese websites in retaliation for anime content depicting the burning of the Kurdish flag. Other major targets include Turkiye, Israel, Germany, and Iran, with the group leveraging DDoS-as-a-service (DaaS) platforms such as EliteStress and Abyssal DDoS v3 to amplify their operations.
Hezi Rash positions itself as a digital defender of Kurdish and Muslim communities, tying its cyberattacks to political and religious motivations. The group maintains a strong presence on social media platforms including Telegram, TikTok, YouTube, and X, and has formed alliances with established hacktivist collectives like NoName057(16), Killnet, and Keymous+. Security researchers recommend organizations bolster their defenses with Web Application Firewall (WAF) challenges, DDoS mitigation services, and enhanced monitoring of residential IP traffic to counter the growing threat posed by Hezi Rash and similar hacktivist operations.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
By early November 2025, security reporting highlighted Hezi Rash's unusually high attack volume for a group of its size and documented its use of alliances and DDoS-for-hire tooling. The reporting identified the group as an emerging hacktivist operation driving a surge in DDoS activity.
Between August and October 2025, Hezi Rash claimed responsibility for approximately 350 distributed denial-of-service attacks. Targets spanned multiple countries, including Japan, Türkiye, Israel, Germany, Iran, Iraq, Azerbaijan, Syria, and Armenia.
Hezi Rash, a Kurdish nationalist hacktivist group also known as 'Black Force in Kurdish,' was established in 2023. The group positioned itself as defending Kurdish and Muslim communities through cyber operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hacktivist groups rapidly turned the Israel-Hamas war into a parallel cyber conflict, launching **DDoS attacks, website defacements, data leak claims, and disruptive messaging operations** against media outlets, government sites, private companies, and public-facing services. Reports said the *Jerusalem Post* suffered outages, the Israeli **Red Alert** missile warning app was targeted, and broader campaigns such as **`#OpIsrael`** and **`OpsRise`** mobilized pro-Palestinian, pro-Russian, and other aligned actors against Israeli targets. Researchers also noted retaliatory activity by pro-Israel groups against Palestinian entities, while spillover attacks hit organizations in countries seen as backing one side or the other. The activity extended beyond websites into physical and operational systems. Attackers reportedly hijacked Israeli smart billboards to display pro-Hamas messages, while analysts warned that opportunistic actors were probing critical infrastructure and operational technology tied to **power, water, fuel, and ISP networks**. Cybersecurity firms and news outlets described the campaign as dominated by loosely coordinated hacktivist collectives, with pro-Palestinian groups outnumbering pro-Israel actors and some cybercriminals joining the fray. At the same time, the Israel-linked group **Predatory Sparrow** resurfaced amid the fighting, underscoring concerns that more capable state-aligned or advanced threat actors could deepen the conflict's cyber dimension.
Jun 29, 2026
Researchers detailed two active Russia-linked threat operations using different intrusion models to target Western organizations. **TA577**, a phishing group active since 2020, was observed sending HTML attachments that force outbound SMB connections to `file://` URLs in order to capture **NTLMv2** authentication handshakes and steal credential hashes. Infrastructure hunting tied the campaign to a narrowed set of likely servers identified through Impacket-like 8-character SMB target names, a distinctive SMB server GUID, shared SSH banner hashes, and recurring hosting patterns across providers including **GLOBALWAYS**; some hosts also exposed a **"We’ll back soon.."** page, login panels, or default Apache pages. A separate analysis examined **NoName057(16)**, a pro-Russian hacktivist collective that has sustained disruptive attacks against Western targets, especially Italian banks, government entities, military infrastructure, and public administrations. The group operates a volunteer-driven DDoS ecosystem known as **DDosia** or **People Go Stresser 2.0**, combining attack tools, support channels, operational guidance, and cryptocurrency rewards to coordinate participants. Its operations primarily use Layer 7 HTTP floods and Layer 4 TCP-SYN attacks, with most traffic aimed at **TLS/443** services but also hitting SSH, FTP, and secure email ports; researchers also noted prior links between the collective and **Bobik RAT** infections used to support DDoS activity.
Jul 12, 2026
Hacktivist activity has increased as tensions involving the United States, Iran, and Israel intensify, according to Sophos threat research. The reported campaigns indicate a rise in politically motivated cyber operations tied to the regional conflict, with threat actors using disruptive and influence-focused tactics to target organizations and amplify geopolitical messaging. The activity reflects a broader pattern in which international crises quickly spill into cyberspace, raising the risk of website defacements, distributed denial-of-service attacks, and other opportunistic intrusions against public- and private-sector targets. Sophos said the escalation underscores the need for organizations with exposure to the region or to politically sensitive sectors to monitor for hacktivist threats and strengthen defensive readiness.
Jun 29, 2026