Threat Actor Characterization
Cyber His-Eyes
ID: 23393f8765dadd2073b1fa03f4d1ca6628920| Cyber His-Eyes Team | His Eyes | Hi********** | hi***** |
| Hi******** | — | — | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
3bc7f1505725f387c1e187edc8763cd797324 | Cyber Fattah Team | Unknown | ally-of | Hacktivist Group |
|
8f27533a6eae91685fa0355542c0b3db | Cyber Islamic Resistance | Lebanon | member-of | Hacktivist Group |
|
5131c1efbf3a402a7200c467fa6fbfc763633 | Iranian Islamic Cyber Resistance | Iran | related | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Cyber His-Eyes is a small Telegram-centered affiliate brand aligned with Cyber Islamic Resistance and closely co-branded with Cyber Fattah in pro-Iran / anti-Israel claim activity. Available evidence supports strong coalition affiliation but does not yet support a high-confidence assessment of Cyber His-Eyes as a mature autonomous intrusion team.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1585.001 | Social Media Accounts | TA0042 | |
| T1583 | Acquire Infrastructure | TA0042 |
|
| T1593 | Search Open Websites/Domains | TA0043 |
|
| T1213 | Data from Information Repositories | TA0009 |
|
| T1499 | Endpoint Denial of Service | TA0040 |
|
| T1491.001 | Internal Defacement | TA0040 |
|
Cyber His-Eyes
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Cyber / Hybrid Hacktivist-Extremist Affiliate Node — Origin: Iran-linked / wider resistance-axis ecosystem (assessed)
Author: iQBlack CTI Team
Executive Summary
Cyber His-Eyes is best modeled at present as a small but operationally themed affiliate brand embedded in the wider Cyber Islamic Resistance (CIR) and Cyber Fattah environment, rather than as a fully independent cyber organization with clearly documented standalone tradecraft. Public evidence shows that the brand is directly forwarded and promoted by CIR, publicly linked through Telegram invite URLs, and co-mentioned with Cyber Fattah in claims framed as the work of the “Iranian Islamic Cyber Resistance Units.”
The strongest current evidence does not support treating Cyber His-Eyes as a mature actor on par with large state-backed intrusion programs. Instead, it points to a coalition-support role inside a pro-Iran / anti-Israel wartime digital ecosystem that blends propaganda, breach marketing, symbolic attack claims, coalition signaling, and public-facing recruitment or contact surfaces. OSINT [B2]
