3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
Abo Omar

Abo Omar

ID: 2c5e9d7d9c904bb71fa38130a565bc4438308
Cybercrime Cybercriminal Hacktivist
Threat types: Hacktivist, Extremist Persona, Propaganda
Lebanon ISR, USA
Updated: 2026-04-14
Created: 2026-04-06
Progress: 92% Completeness: 88% Freshness: 100%
Operation zone: Israel, United States
Aliases Limited alias preview
Abu Omar Brother Abu Omar Ge************** M****
M***** T*** — —
Showing 2 of 6 aliases in free preview.
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: medium
Actor Techniques page ATT&CK® Diagram

Abo Omar, also referenced as Tito and linked to the Mhwear Telegram handle family, is assessed as a public command persona within the Cyber Islamic Resistance / Holy League ecosystem. He appears to coordinate messaging, coalition signaling, and public attribution of disruptive cyber activity rather than acting as a fully resolved standalone intrusion operator.


Technique Technique name Tactics Evidence
T1595 Active Scanning TA0043
  • 2025-04-05 — Aligned reposts reference vulnerability-related material, CMS target lists, and scanning-oriented content distributed through the surrounding ecosystem. · ref
  • 2026-03-01 — INFERENCE (confidence: medium): The launch of a joint operations room and cyber mobilization campaign likely included target discovery and exposed-surface identification before public attack waves. · ref
T1190 Exploit Public-Facing Application TA0001
  • 2025-04-05 — Multiple aligned claims describe compromise of public websites, admin panels, and exposed services, consistent with exploitation of public-facing applications. · ref
  • 2026-03-13 — Claimed breach of MEGINIM DATA SERVICES included screenshots of directories, spreadsheets, and exports from servers, consistent with a public-facing application or web-admin intrusion path. · ref
T1498 Network Denial of Service TA0040
  • 2025-04-05 — Aligned posts pair service disruption claims with public check-host validation links, consistent with DDoS-style impact claims. · ref
  • 2026-03-17 — SOCRadar documents coordinated DDoS claims by groups operating under the same umbrella brand. · ref
T1491.001 Internal Defacement TA0040
  • 2025-04-05 — Aligned ecosystem posts reference multiple website defacements and use mirror links as proof artifacts. · ref
  • 2026-03-04 — SOCRadar documents website defacement claims by Cyber Islamic Resistance and allied channels using coordinated branding. · ref
T1567 Exfiltration Over Web Service TA0010
  • 2025-04-05 — Aligned posts reference archive publication and external sharing of data samples after alleged compromise. · ref
  • 2026-03-13 — INFERENCE (confidence: medium): The publication of sequential alleged data batches from an Israeli cybersecurity firm implies exfiltration and externalized release workflow, although the exact transfer mechanism is not visible. · ref
Strategic Intelligence
Limited preview
Last updated: 2026-04-08T00:06:04+00:00

Abo Omar / Tito / Mhwear — Public Command Persona within the Cyber Islamic Resistance / Holy League Cluster

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Category: Cyber / Hybrid Hacktivist-Extremist Persona — Origin: Unresolved; likely embedded in the Iraq–Syria–Lebanon-facing “axis of resistance” online ecosystem

Author: iQBlack CTI Team


Executive Summary

Abo Omar, also referenced as Tito and associated with the Mhwear Telegram handle family, is best assessed not as a fully resolved real-world individual but as the central public command persona used to brand, coordinate, and legitimize activity under the Cyber Islamic Resistance / Islamic Resistance Axis / Holy League stack. Public channel language repeatedly presents him as a commander, leader, or principal voice of that ecosystem. Multiple Telegram identities in the @Mhwear* family appear to operate as a surrounding communications architecture rather than independent actor brands.


The persona’s intelligence value lies less in attributed hands-on-keyboard tradecraft than in what it reveals about cluster organization. Abo Omar appears to serve as the narrative anchor through which coalition messaging, target signaling, mobilization appeals, ideological framing, and selective operational claims are packaged for public consumption. In practical terms, he functions as a command mask, propaganda focal point, and likely coordinator for a broader anti-Israel cyber-propaganda environment with visible pro-Iran, pro-Hezbollah/Hamas-adjacent, and at times pro-Russian convergence.

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Saved Limited preview

Executive Analyst Brief for CISO — Abo Omar / Tito / Mhwear

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Upgrade to access the full executive brief.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Saved Limited preview

Hunting Playbook — Abo Omar / Tito / Mhwear


Upgrade to access the full hunting playbook.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Saved Limited preview
Last updated: 2026-04-07T13:51:48+00:00

IOC Appendix — Abo Omar / Tito / Mhwear

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

More IOC context for Research. Full appendix for Analyst and Premium plans.
IOC Appendix now
Saved successfully.
OSINT Library
Saved Limited preview
Last saved: 2026-04-10T00:24:47+00:00

OSINT Library — Abo Omar / Tito / Mhwear


2026-04-09 — iQBlack — “The role of Abo Omar in the architecture of Cyber Islamic Resistance”

Full OSINT references available for Research / Analyst.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/4
Address Verification SOCMINT
t.me/Tit****** Restricted Not integrated
t.me/Meh***** Restricted Not integrated
t.me/abo*********** Restricted Not integrated
t.me/CIR** Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
Showing 1–4 of 4 images
Propaganda Free Preview
Propaganda
Telegram account evidence Free Preview
Telegram account evidence
Background image used in a video allegedly recorded by "Brother Abu Omar" Free Preview
Background image used in a video allegedly recorded by "Brother Abu Omar"
Avatar Free Preview
Avatar