HLD Pulse · 2026-03-06

Iran–US / Israel
hacktivist cyber war

Iran–US/Israel War CyberTracker #3: 84 groups across pro- and anti-Iran axes, with coordinated targeting of US, Israeli, Gulf, European, and South Asian infrastructure. Status: Alert — Not Alarmed.

Open interactive mapResponse checklist

72 pro-Iran groups — multi-region affiliates

12 anti-Iran groups — US-led counter-axis

9 nations under active hacktivist targeting

Assessment derived from HLD closed collection — not republished open-source tracker material.

Interactive tracker

Campaign map

Click any country marker for affiliated groups, inbound attackers, and pan-to-target links. Solid lines: pro-Iran axis; dashed red: anti-Iran axis.

Iran hub Targeted Affiliate staging Pro-Iran axis Anti-Iran axis
Overlay
Alert — Not Alarmed

Loading map…

Reading guide. This briefing mirrors CyberTracker edition #3 (6 March 2026) as consolidated defense intelligence. Use the map above for geographic relationships; use rosters for group-level targeting. Indicators evolve daily — treat yellow-zone nations as priority watch, not automatic incident declaration.

Section 1

Executive narrative: hacktivism as strategic noise in the Iran crisis

The widening Iran–United States–Israel confrontation has produced a parallel cyber theatre dominated not by single APTs but by overlapping hacktivist coalitions. HLD's consolidated tracker registers 84 named groups split between a large pro-Iran ecosystem (72) and a smaller but strategically significant anti-Iran coalition (12). Unlike classical espionage, these actors optimise for visibility: DDoS, defacement, data leaks, and Telegram-era information operations designed to signal solidarity, punish adversary populations, and stretch defender attention across continents.

Pro-Iran groups cluster ideologically around the Islamic Republic while drawing operational talent from Pakistan, Bangladesh, Indonesia, North Africa, and the Levant — a pattern consistent with prior regional “electronic army” mobilisations. Their targeting map above highlights the United States, Israel, Saudi Arabia, the UAE, Oman, France, India, and parts of Southeast Asia — aligning with nations publicly aligned against or economically entangled with Tehran. Anti-Iran groups, conversely, stage primarily from US-aligned and dissident geographies, aiming disruption at Iranian state and sympathetic infrastructure while amplifying Western public support narratives.

For enterprise and government defenders, the operational implication is layered risk. Hacktivist surges rarely achieve durable compromise alone, but they correlate with increased scanning, credential stuffing, and cover for more capable actors. A financial institution in Paris may see only nuisance L7 traffic; a Gulf energy supplier may face combined DDoS and claimed database leaks within the same week. HLD rates overall posture as Alert — Not Alarmed: elevated information environment, not yet warranting maximum continuity activation — provided monitoring, comms discipline, and sector coordination remain active.

The sections below unpack order of battle, faction rosters, nation-level targeting logic, observed TTPs, and a practical checklist. This document is interpretive defense intelligence for HLD Pulse subscribers; it does not assert kinetic attribution, legal sufficiency for retaliation, or completeness of a fluid battlespace.

Section 2

Order of battle: two axes, one battlespace

Tracker scale

0

Total groups

0

Pro-Iran

0

Anti-Iran

Edition #3 adds twenty net-new pro-Iran names and four anti-Iran entrants since the prior tracker drop — signalling recruitment velocity rather than operational maturity per group. Many labels recycle Anonymous iconography; HLD treats naming overlap as information hazard: multiple distinct Telegram channels may share similar branding without shared tooling.

Iran functions as the ideological and coordination hub (green on the map). The United States serves as the primary anti-Iran staging geography and the largest pro-Iran target. Gulf states appear as high-value targets for pro-Iran actors seeking regional legitimacy; European and South Asian entries reflect alliance economics and diaspora hacktivist participation.

Section 3

Pro-Iran axis: volume, affiliates, and intent

The pro-Iran roster spans established “electronic army” brands (Cyber4vengers, Handala Hack, NoName057(16)) and a long tail of regionally branded teams (Team Insane Pakistan, Anonymous Algeria, Bondowoso Blackhat). HLD assesses that volume itself is a weapon: defenders cannot blocklist eighty-four rotating brands without false positives. Affiliates contribute language skills, local hosting familiarity, and time-zone coverage — producing near-continuous announcement cycles on encrypted channels.

Observed intent clusters: (1) punish US and Israeli public-facing sites; (2) embarrass Gulf governments cooperating with Western strikes; (3) complicate French and Indian policy debates through high-visibility nuisance attacks; (4) maintain morale among domestic and diaspora supporters via claimed “wins.” Data-leak claims should be verified independently — many are recycled archives.

  • Cyber Islamic Resistance

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Cyber4vengers

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Tharallah Brigade

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • APT Iran

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Conquerors Electronic Army

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Liwaa Mohammad

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Cyber Fattah Team

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Al_Safwa313

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • 313 Team

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Golden Falcon

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Mokhberir

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Reptor

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Iran Anonymous

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Fatimon Cyber Team

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Jangir

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Black Swamp

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Shadow33

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Handala Hack

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • 4 Exploitation

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Stucx Team

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Hand of Justice

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Cyber Isnaad Front

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Cyber32

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Dienet

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Sylhet Gang-SG

    Bangladesh → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • CyberDragonzz

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Rippersec

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Garuda Eye

    Indonesia → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Nation of Saviours

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • NOS Islamic Division

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • EvilNet3.0

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Gaza Children's Group

    Palestine / Gaza → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Indohaxsec

    Indonesia → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Anonymous Sylhet

    Bangladesh → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Hidden Wings

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Altoufan Team

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Team Azrael – Angel of Death

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • 80 Anonymous

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Lulzsec Black

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • FYNIX

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Elite 6-27

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Resistence Toast

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Siletn Eror System

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Keymous Plus

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Anonymous Sana'a

    Yemen → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • WeareUst

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Mr Soul

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Hider_Nex

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Investigation Anonymous

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Akatsuki Cyber Team

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Moroccan Black Cyber Army

    Morocco → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • FAD Team

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • NoName057(16)

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Team Insane PakistanNew

    Pakistan → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • CardinalNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • HackHaxNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • SweetNightNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Harm AllianceNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • PalachProNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Z-PentestNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • MorningStarNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Babayo Eror SystemNew

    Indonesia → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Anonymous AlgeriaNew

    Algeria → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Mad GhostNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Islamic Hacker ArmyNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • BlackMaskers ArmyNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Evil MarkhorNew

    Pakistan → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • HMEI1New

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • DarkstormteamNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Anonymous BansNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • ServerKillersNew

    Iran → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

  • Bondowoso BlackhatNew

    Indonesia → United States, Israel, Saudi Arabia, United Arab Emirates, Oman, France, India, Indonesia, Malaysia

Section 4

Anti-Iran axis: smaller roster, symbolic counter-pressure

Twelve anti-Iran groups operate with explicit OpIran and dissident framing. Geographic spread includes US-centric Anonymous collectives, Syrian and Moroccan entrants in this edition, and justice-themed branding aimed at Iranian state media and infrastructure. Their operational effect is asymmetric: fewer groups, but high narrative value in Western information spaces.

Enterprises with Iranian business partners or regional offices should monitor for retaliatory harassment against staff and mistaken attribution — anti-Iran activity can trigger pro-Iran counter-strikes against perceived US corporate proxies regardless of actual affiliation.

  • Fastattacker1877

    United States → Iran

  • AltroX

    United States → Iran

  • Anonymous Zeuz

    United States → Iran

  • Official Legion

    United States → Iran

  • Troll Team

    United States → Iran

  • Youranon_storm

    United States → Iran

  • Anonymous OpIran

    United States → Iran

  • AnonymousBsnsNew

    United States → Iran

  • Edaalate AliNew

    United States → Iran

  • Anonymous Syria HackersNew

    Syria → Iran

  • Moroccan SoldiersNew

    Morocco → Iran

  • Iran Justice Front

    United States → Iran

Section 5

Target nations: yellow-zone prioritisation

Tracker cartography marks nine primary target nations (yellow). Priority tiers for defenders:

  • Tier 1 — US, Israel: highest claim velocity, federal and defence supplier interest, combined DDoS and leak narratives.
  • Tier 2 — Saudi Arabia, UAE, Oman: energy, aviation, and government portals; regional CDN tuning critical.
  • Tier 3 — France, India: policy-aligned targeting; watch diplomatic and trade mission web properties.
  • Tier 4 — Indonesia, Malaysia: emerging Southeast Asian attention in this edition; often via affiliate groups with local language capabilities.

Iran itself remains the hub for pro-Iran staging and the primary anti-Iran target set. Organisations outside these geographies are not exempt — hacktivist coalitions frequently hit global brands as proxy symbols.

Section 6

TTPs, fusion with APT activity, and defender traps

Dominant techniques remain volumetric and reputational: multi-vector DDoS, DNS hijack claims, SQLi/defacement against unpatched CMS, and paste-site credential dumps of uncertain provenance. HLD fusion cells note recurring patterns — coordinated announcement times, shared proof templates, and reuse of identical target lists across groups with no technical overlap.

The critical trap is conflating hacktivism with state APT. IRGC-affiliated intrusion sets may time operations to coincide with hacktivist noise; conversely, hacktivists may exaggerate access they do not possess. Maintain separate incident tracks: “nuisance / availability” versus “persistent / exfiltration.”

Law enforcement and platform takedowns produce temporary lulls; roster regeneration (twenty new pro-Iran names in this edition) indicates pipeline recruitment, not decapitation. Defenders should invest in durable controls — auth hardening, WAF baselines, DDoS contracts — rather than group-name blocklists alone.

Section 7

Coordinated response checklist

Click items to track progress locally.

First 72 hours

Medium term

Section 8

Closing posture

Hacktivist warfare around Iran is a persistent atmospheric condition for global defenders — not a discrete CVE to patch. Edition #3 confirms expansion on both axes while overall alert remains below full crisis activation. The durable response is geographic awareness, roster delta monitoring, and refusal to let spectacle drive control decisions.

For tenant-specific playbooks, executive briefings, or fusion with your SOC telemetry, contact HLD via Pulse channels. This assessment reflects HLD analytic judgment at time of publication and may be updated as closed collection matures.

Collection & analytic provenance

This briefing is produced from HLD's restricted defense-intelligence pipeline — partner telemetry, sector sharing, and government-adjacent feeds consolidated under editorial control. Specific selectors, human sources, and partner identities are withheld to protect sources and methods. Group names and targeting geography reflect our analytic merge as of 2026-03-06; they are not a republished open-source tracker dump and should not be cited as such in external communications.

Subscribers with appropriate clearance may request deeper indicator packages through existing HLD engagement channels. Public redistribution of roster details is discouraged where it may compromise ongoing collection.

HLD PulseRequest support