Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026

MITRE Techniques

• [T1498 ] Network Denial of Service – Used extensively to disrupt targets through DDoS campaigns, including the Canonical and Ubuntu infrastructure attack (‘DDoS attacks’ / ‘commercial stresser tools’).
• [T1491.001 ] Defacement: Internal Defacement – Website defacements were repeatedly described as part of the actors’ disruptive tradecraft (‘website defacements’ / ‘defacement-style activity’).
• [T1595 ] Active Scanning – Evil Markhors was described as performing reconnaissance scanning and exposed-system discovery (‘reconnaissance scanning’ / ‘exposed-system discovery’).
• [T1110.003 ] Password Spraying – Evil Markhors likely used password spraying to enable access in support of coalition activity (‘password spraying’).
• [T1078 ] Valid Accounts – The report discusses credential reuse and credential aggregation as a pathway to compromise (‘credential reuse’ / ‘credential aggregation’).
• [T1590 ] Gather Victim Network Information – Public proof-of-impact services and exposed-system discovery were used to validate or identify targets (‘check-host[.]net to confirm events’ / ‘exposed-system discovery’).
• [T1589 ] Gather Victim Identity Information – Handala and Cyber Isnaad Front focused on intimidation, identity exposure, and doxxing-oriented campaigns (‘identity exposure’ / ‘doxxing’).
• [T1586 ] Compromise Accounts – The ecosystem used recycled breach data and credential-related activity to support claims or access efforts (‘recycled breach data’ / ‘credential harvesting’).
• [T1486 ] Data Encrypted for Impact – Fatimiyoun/FAD Team referenced wiper malware and permanent destruction narratives (‘wiper malware’ / ‘permanent destruction narratives’).
• [T1090 ] Proxy – The article frames many actors as deniable auxiliaries or proxies within a broader Iranian-aligned wartime ecosystem (‘deniable asymmetric auxiliaries (e.g. proxies)’).