3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
FAD Team

FAD Team

ID: 3412c085cd48f2aac22c28d06be5d8ec94981
Hacktivist Group Hacktivism
Threat types: Hacktivism, Intrusion, Data Theft, Data Leak, SQLi, Pro-Iran
Iran ISR
Updated: 2026-04-07
Created: 2026-01-22
Progress: 91% Completeness: 92% Freshness: 90%
Operation zone: Israel
Aliases Limited alias preview
Alien Team Equipo Electrónico de Fatimiyoun FA************** Fa***********************
Fa***************** Fa******** Fa************************ Ir*******************
Th************ فا***** فر********************* —
Showing 2 of 11 aliases in free preview.
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: medium
Actor Techniques page ATT&CK® Diagram

FAD Team is referenced in early 2026 reporting as an Iran-aligned hacktivist brand (Fatimiyoun/Fatimion cyber team / Resistance Hub). Reporting associates the group with SQL injection and code injection claims leading to data theft/PII leaks, alongside a destructive posture characterized by vendor reporting as wiper-focused permanent data destruction.


Technique Technique name Tactics Evidence
T1190 Exploit Public-Facing Application TA0001
  • 2026-03-03 — SQL injection reported as method used for data theft across targets. · ref
  • 2026-03-03 — Flashpoint-derived reporting describes global SQL injection campaign leaking PII. · ref
T1005 Data from Local System TA0009
  • 2026-03-03 — PII leaks imply collection of data from databases/local systems after access (mechanism not fully detailed). · ref
T1485 Data Destruction TA0040
  • 2026-03-03 — Vendor reporting characterizes FAD Team as focusing on wiper malware and permanent data destruction. · ref
T1498 Network Denial of Service TA0040
  • 2026-03-04 — INFERENCE (confidence: low–medium): ecosystem disruption reporting lists FAD Team among active brands; DDoS/DoS may be used campaign-dependently. · ref
T1585 Establish Accounts TA0042
  • 2026-03-04 — Public claims and coordination via social channels are described across reporting; specific channel ownership should be validated. · ref
Strategic Intelligence
Limited preview
Last updated: 2026-03-04T21:12:24+00:00

FAD Team - Iran-aligned hacktivist brand (data theft + disruption/destruction)

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Saved Limited preview

Executive Analyst Brief for Decision Makers — FAD Team

Classification: Unclassified / OSINT — TLP:WHITE

Upgrade to access the full executive brief.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Saved Limited preview

Hunting Playbook — FAD Team


Upgrade to access the full hunting playbook.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Saved Limited preview
Last updated: 2026-03-04T21:29:10+00:00

IOC Appendix — FAD Team

Classification: Unclassified / OSINT — TLP:WHITE

More IOC context for Research. Full appendix for Analyst and Premium plans.
IOC Appendix now
Saved successfully.
OSINT Library
Saved Limited preview
Last saved: 2026-03-04T21:14:47+00:00

OSINT Library — FAD Team


2026-03-03 — Palo Alto Networks Unit 42 — “Threat Brief: March 2026 Escalation of Cyber Risk ...”

Full OSINT references available for Research / Analyst.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/15
Address Verification SOCMINT
x.com/hak*** Restricted Not integrated
Address Verification SOCMINT
t.me/r3_** Restricted Not integrated
t.me/Fat************ Restricted Not integrated
t.me/Fat************ Restricted Not integrated
t.me/Fat************ Restricted Not integrated
t.me/Fat************ Restricted Not integrated
t.me/fat******* Restricted Not integrated
t.me/hkr*** Restricted Not integrated
t.me/hak*** Restricted Not integrated
t.me/hak*** Restricted Not integrated
t.me/hak*** Restricted Not integrated
t.me/aa4******* Restricted Not integrated
t.me/+Rr************** Restricted Not integrated
t.me/joi********************** Restricted Not integrated
t.me/FAD***** Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
Showing 1–4 of 4 images
Hacked website Free Preview
Hacked website
Avatar used in social media account Free Preview
Avatar used in social media account
Propaganda Free Preview
Propaganda
Logo Free Preview
Logo