Cyber Islamic Resistance

Summary

Pro-Iranian hacktivist umbrella that Unit 42 says coordinates teams such as RipperSec and Cyb3rDrag0nzz in synchronized DDoS, data-wiping and defacement claims against Israeli and Western infrastructure; CSIS lists it among 'Iranian-backed and affiliated' hacktivist groups whose operations tracked military developments. SOCRadar's Telegram timeline (Mar 2026) calls it an Iraqi-Syrian joint collective and records claims against a Tel Aviv hotel, the Israeli firms MEGINIM Data Services and Logit E.D and the WeLearn academic platform (with FAD Team), alleged ICS/PLC access, a joint defacement of a Saudi university with 313 Team, and DDoS claims on Microsoft cloud services by 313 Team and Anti-Zionist Cyber Group 'under the Cyber Islamic Resistance umbrella'. Vendors differ on membership: Unit 42 lists 313 Team (Islamic Cyber Resistance in Iraq), FAD Team, Dark Storm Team, Sylhet Gang and DieNet as separate entities in an ecosystem of about 60 groups. SecurityScorecard (Aug 2025), whose analysis of 250,000+ Telegram messages from 178+ hacktivist and proxy groups CSIS cites, read 242 of the collective's posts from March to June 2025 — 17 claimed defacements and service disruptions, including a claimed hack of Hadassah Ein Kerem Hospital during the 12-day war — and assesses it, at moderate confidence, as a likely Iran-aligned proxy using Palestinian narratives whose direct state sponsorship is unconfirmed. No vendor has verified the collective's claimed impacts, and no Iranian state body is named.

Attribution

No specific Iranian state body named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• CSIS (Research, 2026)
  Iranian-backed and affiliated hacktivist collective

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 2

Infrastructure patterns

• Joint claims with allied personas — 313 Team, FAD Team, Anti-Zionist Cyber Group (SOCRadar, Mar 2026)

Reporting and advisories 1

• Unit 42
  2026 Iran-war hacktivist DDoS, wiping and defacement claims