Threat Actor Characterization
Palestinian Electronic Army
ID: 93471f70195a3e6db81b1ddf987172ce83870| Ejército Electrónico Palestino | P.E.A. | Pa**************** | P** |
| ال************************ | — | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Palestinian Electronic Army is best assessed as a pro-Palestinian digital activist and propaganda-mobilization brand operating across public social platforms, with limited evidence of autonomous offensive cyber capability and stronger evidence of messaging, mobilization, and doxxing-adjacent pressure.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1071.001 | Web Protocols | TA0011 |
|
| T1589 | Gather Victim Identity Information | TA0043 |
|
| T1592 | Gather Victim Host Information | TA0043 |
|
| T1583 | Acquire Infrastructure | TA0042 |
|
| T1565.001 | Stored Data Manipulation | TA0040 |
|
Palestinian Electronic Army — activist cyber-propaganda and mobilization brand
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Hacktivism / Propaganda-Mobilization / Low-confidence cyber activism cluster - Origin: Palestine-facing digital activist environment (exact origin unresolved)
Author: iQBlack CTI Team
Executive Summary
Palestinian Electronic Army (PEA) is best assessed as a loose pro-Palestinian digital activist and propaganda brand rather than a clearly bounded cyber threat group with consistently demonstrated autonomous intrusion capability. Public traces point to a long-running social-media presence across Facebook, X, and Telegram under the “Palestinian Electronic Army” label, with messaging centered on Palestinian solidarity, anti-Israel narratives, online mobilization, and low-barrier digital participation.
The strongest current public evidence indicates that at least some PEA-branded channels emphasize media amplification, translated messaging, social campaigns, and online pressure tactics such as reporting or disrupting Israeli social-media accounts. One Telegram description explicitly frames the mission as publishing translated texts on foreign websites, closing Israeli Instagram accounts, and conducting media campaigns directed at Western audiences. This points to a digitally activist information-operations model rather than a mature offensive cyber unit.
