Assessment date: 6 July 2026

Executive Assessment

Hacktivism is no longer just online vandalism or nuisance activity. In a geopolitical crisis, it works as an amplifier. Even when individual actors are not technically advanced, they can still create real pressure by moving fast, choosing symbolic targets, making public claims, and rallying others around a political cause. The ASPI report makes this point clearly. Since 2022, hacktivist activity has repeatedly surged around wars, regional crises, and political flashpoints. During one recent Middle East escalation, hacktivist groups claimed more than 149 incidents in three days against government, financial, telecom, and critical infrastructure targets.

This fits the pattern particularly seen in the pro-Iran and “Axis of Resistance” cyber ecosystem. That ecosystem is not best understood as a traditional APT. It operates more like a loose wartime disruption network. Groups coordinate on Telegram, amplify one another’s claims, run DDoS attacks, deface websites, reuse leaked data,and publish leak claims in service to push propaganda. Their strength is not elite technical capability, it’s speed, visibility, mass participation, and the ability to turn cheap cyber activity into psychological and political pressure.

Hacktivism now connects several threat streams at once. It links geopolitical messaging, criminal tools, opportunistic hacking, influence operations, and state-aligned deniability. During a crisis, that network effect can matter more than the skill level of any single group.

Key Judgments

1. Hacktivism is reactive, but increasingly predictable.
Hacktivist activity often spikes around wars, sanctions, and regional escalations. The assessment is that defenders should not treat these events and the noise generated by the actors as background noise. They can provide early warning that a crisis is moving from rhetoric into coordinated cyber disruption.. (The Strategist)

2. The main risk is cumulative disruption, not one catastrophic compromise.
Most hacktivist activity remains low to mid-level. It usually involves DDoS attacks, website defacements, reused credentials attacks and low hanging fruit attacks to leak claims and harassment as propaganda. The damage comes from timing and volume. During a crisis, repeated disruptions organizations can weaken public trust. They can also distract executives, overload SOC and communications teams, and create cover for more capable state-linked operations.

3. State relationships are indirect, deniable, and operationally useful.
The relationship between hacktivists and APTs is rarely clean. The connection of indirect influence, opportunistic alignment with state interests, signal amplification, and plausible deniability are clear. The clearest public example is the pro-Russian ecosystem. A multi-agency advisory assessed that GRU Unit 74455 likely supported the creation of Cyber Army of Russia Reborn and funded tools used for DDoS operations through at least September 2024, while NoName057(16) was assessed as a Kremlin-linked covert project using Telegram and the DDoSia toolchain. (Cyber.gov.au)

4. Iran-aligned hacktivism is best understood as a layered cyber-influence system.
The Iran/Axis ecosystem contains a more capable state-linked core, including MOIS-linked personas such as Handala, Homeland Justice, and Karmabelow80. A looser proxy layer including 313 Team, DieNet, Dark Storm Team, Cyber Islamic Resistance, and others opportunistically aligned create a constellation of actors and groups active today. The assessment judged, is that this structure gives Iran deniability, scale, and persistence while reserving more capable destructive or espionage operations for state-linked elements.

5. OT and critical infrastructure exposure changes the risk equation.
Hacktivists do not need advanced ICS tradecraft to create operational risk. Internet-exposed HMIs, VNC panels and PLCs with default credentials, weak remote access, shared operator accounts, and poor IT/OT segmentation give low-skill actors enough access to produce visible disruption. CISA-partner reporting on pro-Russia hacktivists notes that these groups use easily replicated TTPs, often misunderstand industrial processes, frequently exaggerate their effects, but have still caused actual harm to vulnerable critical infrastructure. (Cyber.gov.au)

Threat Environment

Research has identified the central blind spot: defenders often dismiss hacktivists because they communicate informally, exaggerate claims, use broken English, post memes, and lack polished tradecraft. That is a mistake. Informality does not equal incapacity. The increasing availability of denial-as-a-service platforms, public exploit kits, credential stuffing tools, open-source attack frameworks, and generative AI as lowering the barrier to participation. (The Strategist)

The modern hacktivist ecosystem functions through mobilization. A crisis occurs. Telegram channels circulate target lists. Coalition actors select weak public-facing sites. Attacks follow quickly, often within hours. Claims, screenshots, check-host reports, recycled data dumps, and propaganda graphics then create the public-facing operation.

Radware’s reporting on the late February to early March 2026 Middle East escalation shows the tempo clearly. It reported hacktivist mobilization within nine hours of the triggering military operation, with Keymous+ and DieNet driving nearly 70 percent of activity between February 28 and March 2, government institutions accounting for 53 percent of attacks, and Kuwait, Israel, and Jordan representing more than 76 percent of claims. (Radware) Radware also recorded 149 attack claims against 110 organizations in 16 countries over three days, with Keymous+, DieNet, and NoName057(16) accounting for 74.6 percent of global claims in that window.

Actor Ecosystems

Pro-Iran and Axis-Aligned Layer

The pro-Iran cyber ecosystem is not a single command structure. It is a loose mobilization network made up of hacktivist brands, ideological cyber militias, propaganda actors, criminal-adjacent groups, and state-adjacent influence nodes. These groups use DDoS attacks, website defacements, hack-and-leak claims, credential theft, doxxing, intimidation, and extortion-style messaging to create pressure during geopolitical crises. Their targets often include government, telecom, healthcare, finance, logistics, energy, and open-source infrastructure. Groups such as Handala, 313 Team, Cyber Islamic Resistance, Fatimiyoun/FAD Team, Dark Storm, CJM, Keymous+, DieNet, MONARCH, Killnet, and related actors help create the image of a broad transnational cyber front through shared propaganda, repeated disruption, leak operations, and anti-Western or anti-Israel messaging.

Within that layer, actor roles differ:

Handala acts as a higher-credibility hack-and-leak and intimidation node. It is more psychologically sophisticated than most DDoS-centric crews and specializes in reputational harm, PII exposure, coercive messaging, and leak publication.

313 Team is a resistance-branded disruption actor focused on DDoS, Telegram propaganda, symbolic targeting, and coalition amplification. Its reported participation in the May 2026 Canonical/Ubuntu disruption showed the strategic leverage of attacking widely used open-source infrastructure with relatively simple methods.

Cyber Fattah, Fatimiyoun/FAD Team, CJM, Keymous+, DieNet, and MONARCH contribute attack volume, rhetoric, target lists, and claims amplification. Their utility is in participation and coalition signaling.

Dark Storm Team represents the criminal-adjacent edge of the ecosystem, where DDoS, ransomware narratives, and wartime propaganda blur.

Evil Markhors and similar reconnaissance/credential actors matter because access-enablement can raise the effectiveness of an otherwise low-skill coalition. Credential reuse and exposed-system discovery can create downstream compromise opportunities.

Pro-Russian Hacktivist Layer

The Russian hacktivist ecosystem shows a clearer model of deniable cyber auxiliaries operating near state interests. Public advisories identify Cyber Army of Russia Reborn, NoName057(16), Z-Pentest, Sector16, and related actors as opportunistic threats to global critical infrastructure. These include water, food, agriculture, and energy infrastructure. CARR began as a Telegram-based pro-Russian brand focused on DDoS claims against the U.S. and Europe over support for Ukraine. It later moved into ICS-related claims involving wastewater and HMI targets. NoName057(16) used Telegram and GitHub to distribute DDoSia and coordinate attacks against NATO and European targets. Z-Pentest then emerged as a more OT-focused offshoot, shifting attention toward claimed intrusions, leaks, and defacements. The progression matters because it shows how DDoS crews can evolve into access-seeking actors when tooling, attention, and incentives change.

State APT Overlap

Hacktivists are not Sandworm, APT44, APT28, MOIS, or IRGC operators. But they operate in ecosystems influenced by those actors.

Russia’s APT44/Sandworm remains a different class of threat. Mandiant assesses APT44 as a mature GRU actor integrating espionage, attack, and influence operations, with a long history of disruptive and destructive operations against Ukraine and critical infrastructure. (Google Cloud) Mandiant also describes a repeatable GRU disruptive playbook designed to increase speed, scale, and intensity of offensive cyber operations in contested wartime environments.

The practical implication is that hacktivist noise may coexist with, amplify, or obscure more disciplined state operations. During the Russia-Ukraine war, Google and Mandiant observed destructive attacks, cyber espionage, information operations, and hack-and-leak activity tied to Russian objectives. Google noted that Russia-backed targeting of users in Ukraine rose 250 percent in 2022 compared to 2020, with NATO-country targeting rising over 300 percent. (blog.google)

TTP Assessment

Hacktivist tradecraft is usually simple but effective at scale. Common activity includes DDoS attacks, website defacements, credential stuffing, password spraying, and the reuse of leaked or stolen credentials. Groups often share target lists through Telegram and then publish screenshots or third-party availability checks as proof of impact. They also recycle old breach data and present it as new compromise. In more aggressive cases, they use doxxing, harassment, intimidation, hack-and-leak operations, and exposed OT access such as VNC, HMI, PLC, or weak remote access systems. The technical activity is then amplified through propaganda graphics, memes, videos, hashtags, and synchronized public claims.

The OT-specific risk is not theoretical. CISA-partner reporting on IRGC-affiliated CyberAv3ngers states that the actors targeted and compromised Unitronics Vision Series PLCs commonly used in water and wastewater, energy, food and beverage manufacturing, and healthcare, with activity tied to default credentials on internet-exposed devices. (American Hospital Association) WaterISAC guidance on the same activity emphasized that exposed PLCs, default passwords, default ports, and unsecured remote access remain urgent risks, and it advised asset owners to avoid connecting PLCs directly to the internet, secure remote access behind firewalls or VPNs, implement MFA where possible, and change default PLC communications ports. (WaterISAC)

For pro-Russian actors, the critical pattern is exposed VNC and HMI access. The CISA-partner advisory notes that these actors scan for vulnerable internet-facing devices, use VPS infrastructure, brute force passwords, access hosts over VNC, and manipulate HMI/SCADA environments, while often exaggerating actual effects. (Cyber.gov.au)

Strategic Impact

The strategic impact of hacktivism is not defined only by how deep the compromise goes. It is shaped by timing, visibility, and disruption, as narrative. A DDoS attack against a government portal may be minor in normal conditions. During missile exchanges, energy panic, civil unrest, election tension, or a national security crisis, the same attack becomes part of the information fight. It can force public statements, trigger media coverage, and create fear that critical infrastructure is under attack. It can also blur the line between a real intrusion, a temporary outage, an old data leak, or a false claim. This is why early hacktivist activity should be treated as warning signal. Telegram posts, X activity, target lists, DDoS claims, defacements, and recruitment calls can show when rhetoric is turning into coordinated cyber disruption.

Defensive Implications

Defensive planning should not be APT-only. The threat model must include mass participation, low-skill coordinated campaigns, and opportunistic disruption. Here are the defensive actions against hacktivist threats orgs should enact as a countermeasure to attacks and leaks.

Final Assessment

Hacktivism has evolved from nuisance activity into a steady geopolitical pressure tool. It is still noisy, uneven, and often technically shallow. Which is exactly why it gets underestimated. The better model is not hacktivists versus APT’s, it is an ecosystem where hacktivist influence operations overlap with state goals. Hacktivists bring speed, scale, noise, deniability, and psychological impact. State actors bring direction, infrastructure, selective capability, and strategic framing. During geopolitical crises, hacktivist activity should be treated as an early warning layer. The danger is not that every hacktivist becomes advanced. The danger is that simple, accessible, and scalable disruption keeps being underestimated.