Threat Actor Characterization
Cyber Toufan
ID: b2fc44bfdc7ac3aa9ca236d3d5522965| Cyber Flood of Al-Aqsa | Cyber Iraq | Cy**************** | Cy****************** |
| Cy****************** | Cy***************** | Cy********************* | Cy********* |
| Cy*************** | Hi****************** | Th************************************* | ال***************************** |
| سا**************** | — | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Cyber Toufan is a pro-Palestinian, anti-Israel hybrid hacktivist/proxy brand active since late 2023. Public reporting links it to data theft, leak operations, destructive claims, valid-account abuse, and Israel-focused campaigns that may benefit from Iran-aligned support or enablement.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1021.001 | Remote Desktop Protocol | TA0008 |
|
| T1213 | Data from Information Repositories | TA0009 |
|
| T1567 | Exfiltration Over Web Service | TA0010 | |
| T1586.002 | Email Accounts | TA0042 |
|
| T1485 | Data Destruction | TA0040 | |
| T1491.001 | Internal Defacement | TA0040 |
|
| T1583.001 | Domains | TA0042 |
|
Cyber Toufan / Cyber Toufan Al-Aqsa / Cyber Toufan Operations
Classification: TLP:WHITE — (Cyber / Hybrid Hacktivist Brand / Suspected Iran-aligned Proxy Cluster)
Author: iQBlack Team
Executive Summary
Cyber Toufan is a pro-Palestinian, anti-Israel threat actor brand that emerged in the immediate aftermath of the October 2023 Hamas attack and rapidly evolved into one of the most visible “hack-and-leak” identities operating against Israeli targets. Public reporting from late 2023 through early 2026 consistently describes the group as combining real intrusions, aggressive leak publication, destructive or disruptive claims, and a high-volume propaganda layer delivered through Telegram and related channels.
Open reporting indicates that Cyber Toufan has targeted Israeli public and private entities across government, web hosting, technology, defense-adjacent, retail, e-commerce, and education environments. The actor’s most notable early operational moment was the compromise of Signature-IT, an Israeli hosting and e-commerce service provider, which enabled downstream exposure of multiple customer organizations and set the tone for a campaign built around centralized access, staged leak cadence, and psychological pressure.
