3C-INT | [Cyber]Crime Characterization for Intelligence

Nation Of Saviors

ID: cf294afa67a2b6b7f0b8f1a741db720e

Hacktivist Group Hacktivism

Threat types: Hacktivism, Intrusion, Defacement, DDoS, Pro-Palestine, Pro-Iran

Unknown BGD, IND, ISR, KWT, SAU, GBR, USA

Updated: 2026-04-12

Created: 2026-01-20

Progress: 95% Completeness: 96% Freshness: 100%

Operation zone: Bangladesh, India, Israel, Kuwait, Saudi Arabia, United Kingdom, United States

Aliases Limited alias preview

NationOfsaviors	NOS	NO**************	NO******************
NO********	NO****************	—	—

Showing 2 of 6 aliases in free preview.

Associated Threat Relationships

Limited preview

Related profiles 15
Related files 0

Related profiles

ID	Threat	Origin	Type	Categories
9fe28571e0feb2a6491a4474496ca84e36361	N3M3SÎS	Unknown	member-of	Cybercrime
63f65216a472f97ffa5d36609d72099393863	7thDay	Unknown	related	Hacktivist Group
9f9ab2a2d4c5a8002326eac8fb84a615	BD Anonymous Team	Bangladesh	ally-of	Hacktivist Group
5d591571e532da891c02de7ea2fc629906806	Black Hat Zombie	Unknown	ally-of	Hacktivist Group
741b9c48141d50c355bd01dc51eeeb3582254	Cyb3r Drag0nz	Unknown	related	Hacktivist Group
8f27533a6eae91685fa0355542c0b3db	Cyber Islamic Resistance	Lebanon	ally-of	Hacktivist Group
f52c21e28be1cb613b5f5ea926a12aec12625	Cyber Team Indonesia	Indonesia	ally-of	Hacktivist Group
84d6b3f7430f604990757f664fdff7ac33098	Garuda Eror System	Indonesia	ally-of	Hacktivist Group
17189542de4cc617097bb5248e707a89	Holy League	Russia	ally-of	Hacktivist Group
78dd1c3c3dfc6fcbbda95d743ab0e2f732121	NoName057(16)	Russia	ally-of	Hacktivist Group
6414480505a9607a699363d9310b6ca358769	Red Wolf Cyber Team	Iran	ally-of	Hacktivist Group
044d911259027e0bf863b1ecdfcf85cc	RipperSec	Unknown	ally-of	Hacktivist Group
1afa690e6f6abf772452bbbf4b5057fc78285	Team BD Dark Force	Bangladesh	ally-of	Hacktivist Group
8a14ce81fcac2b66a7f56565a0cd6c4b70977	Team Insane Pakistan	Pakistan	ally-of	Hacktivist Group
73c8b02d2786934ce41c756164d6863d66403	V For Vendetta Cyber Team	Indonesia	ally-of	Hacktivist Group

Related files

No related files found.

Actor Network Graph

Open Network Graph

Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.

MITRE ATT&CK®

confidence: medium

Actor Techniques page ATT&CK® Diagram

Nation Of Saviors is a coalition-aligned hacktivist collective publicly associated with pro-Palestinian and pro-Pakistan narratives. Open reporting ties it most strongly to DDoS-led disruptive campaigns against Indian state-linked targets and, later, anti-Israel and Gulf-related conflict activity.

Technique	Technique name	Tactics	Evidence
T1498	Network Denial of Service	TA0040	2025-05-09 — Cyble reported that Nation Of Saviors launched two concentrated waves of DDoS attacks targeting India’s state infrastructure, including defense, law enforcement, education, and e-governance. · ref 2025-06-19 — SOCRadar recorded the group’s claim that it took down Israel’s Alon Group website via DDoS. · ref 2026-03-02 — Radware / downstream reporting described a Nation Of Saviors claim promising to hold a DDoS attack against Israel’s Alon Group for more than 20 hours. · ref
T1491.001	Internal Defacement	TA0040	2025-05-15 — INFERENCE (confidence: medium): Public reporting on the broader India-focused campaign describes loose hacktivist collectives, including Nation Of Saviors, as espousing defacements alongside DDoS. This supports conservative mapping to website impact / defacement behavior. · ref 2025-00-00 — INFERENCE (confidence: medium): Profile-style OSINT describes Nation Of Saviors as combining anti-India operations with defacement and DDoS activity. · ref
T1595	Active Scanning	TA0043	2026-03-09 — INFERENCE (confidence: medium): The actor’s recurring focus on symbolic public web targets implies routine target discovery and exposed-service identification before campaigns. · ref 2025-05-08 — INFERENCE (confidence: medium): Repeated targeting of public institutions and exposed services is consistent with active reconnaissance for visible internet-facing assets. · ref
T1589	Gather Victim Identity Information	TA0043	2025-05-12 — INFERENCE (confidence: medium): Sustained India-related posting and symbolic target focus suggest collection of target identity and contextual information for narrative-driven operations. · ref 2025-00-00 — INFERENCE (confidence: medium): OSINT profiling describes the group as targeting Indian public and private sector entities and named institutions such as the Indian Air Force, implying purposeful target selection rather than random disruption. · ref
T1020	Automated Exfiltration	TA0010	2026-03-09 — INFERENCE (confidence: low-medium): SOCRadar’s dashboard attributes a 21GB exfiltration claim against Saudi engineering firm Baran Company to Nation Of Saviors, but independent verification remains limited. · ref

Strategic Intelligence

Limited preview

Last updated: 2026-04-12T15:03:10+00:00

Preliminary Strategic Intelligence

Nation Of Saviors — pro-Palestinian / pro-Pakistan hacktivist collective

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Category: Hacktivism / Ideologically aligned disruptive operations — Origin: likely South Asian nexus with strong anti-India and pro-Palestinian alignment; precise home base unconfirmed

Author: iQBlacl CTI Team

Executive Summary

Nation Of Saviors appears to be a relatively recent hacktivist collective that became visibly active during 2024 and accelerated through 2025 into early 2026. Public reporting consistently places the group inside a broader pro-Palestinian and pro-Pakistan online militant ecosystem, with recurring anti-India targeting and later participation in anti-Israel and Gulf-focused campaigns. The group’s public behavior is heavily claim-driven and shaped by Telegram-native amplification.

The most consistently supported activity pattern is disruptive rather than stealthy. Public reporting links the group primarily to DDoS claims, periodic website defacement narratives, and a smaller number of data-leak or doxxing claims. The available record does not currently support treating Nation Of Saviors as a high-maturity intrusion actor with a well-documented proprietary malware stack. It is better modeled as a coalition-era hacktivist node that exploits political momentum, alliance branding, and symbolic target selection.

Full strategic intelligence is available in Analyst and Premium plans.

Executive Analyst Brief for CISO

Saved Limited preview

Executive Analyst Brief for CISO — Nation Of Saviors

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Upgrade to access the full executive brief.

Tip: Hover the section title to learn what’s included in Analyst / Premium plans.

Saved successfully.

Hunting Playbook

Saved Limited preview

Hunting Playbook — Nation Of Saviors

Upgrade to access the full hunting playbook.

Tip: Hover the section title to learn what’s included in Analyst / Premium plans.

Saved successfully.

IOC Appendix

Saved Limited preview

Last updated: 2026-04-12T15:02:14+00:00

IOC Appendix — Nation Of Saviors

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

More IOC context for Research. Full appendix for Analyst and Premium plans.

Saved successfully.

OSINT Library

Saved Limited preview

Last saved: 2026-04-12T15:02:30+00:00

OSINT Library — Nation Of Saviors

2025-05-08 — Radware — “Escalating Hacktivist Attacks Amidst India-Pakistan Tensions”

Full OSINT references available for Research / Analyst.

Saved successfully.

Social Medial & Communication

SOCMINT integrated: 0/18

Address	Verification	SOCMINT
`x.com/Nat************`	Restricted	Not integrated

Address	Verification	SOCMINT
`t.me/+e4**************`	Restricted	Not integrated
`t.me/+XE**************`	Restricted	Not integrated
`t.me/nos**************`	Restricted	Not integrated
`t.me/+9u**************`	Restricted	Not integrated
`t.me/+-0**************`	Restricted	Not integrated
`t.me/+Sh**************`	Restricted	Not integrated
`t.me/+UE**************`	Restricted	Not integrated
`t.me/dat*************`	Restricted	Not integrated
`t.me/nat*********************`	Restricted	Not integrated
`t.me/Nat****************`	Restricted	Not integrated
`t.me/nos*****`	Restricted	Not integrated
`t.me/+X0**************`	Restricted	Not integrated
`t.me/+q-**************`	Restricted	Not integrated
`t.me/+tI**************`	Restricted	Not integrated
`t.me/+-S**************`	Restricted	Not integrated
`t.me/+S5**************`	Restricted	Not integrated