Threat Actor Characterization
Numour al-Huriya
ID: ea8c965e6679d4e392aca721eb05d2bc| Numour alHuriya | Tigers of Liberty | نم********* | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Numour al-Huriya ("Tigers of Liberty") is a lightly documented opposition-aligned cyber/propaganda identity linked in public reporting to the 2017 compromise of Bahraini Foreign Minister Khalid bin Ahmed Al Khalifa’s social-media account. The actor appears focused on symbolic political messaging and account hijack effects rather than broad enterprise intrusion.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1586.001 | Social Media Accounts | TA0042 |
|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1566 | Phishing | TA0001 |
|
| T1565.001 | Stored Data Manipulation | TA0040 |
|
| T1102.002 | Bidirectional Communication | TA0011 |
|
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Hacktivism / Opposition-aligned cyber-propaganda identity — Origin: Claimed Qatif, Eastern Province, Saudi Arabia / Bahrain-linked opposition ecosystem
Author: iQBlack CTI Team
Executive Summary
Numour al-Huriya (“Tigers of Liberty”) is a sparsely documented but genuine opposition-aligned cyber/propaganda identity that entered public reporting during the June 2017 compromise of Bahraini Foreign Minister Khalid bin Ahmed Al Khalifa’s X/Twitter account. Public reporting consistently states that the hijacked ministerial account was used to repost content from Numour al-Huriya and to circulate anti-monarchy messaging.
The available evidence does not support treating Numour al-Huriya as a mature intrusion set or long-running advanced cyber actor. The strongest public anchor is a short-lived, symbolically potent social-media account takeover that amplified anti-regime content tied to Bahraini Shi’a opposition narratives and to the wider unrest environment affecting Bahrain and the Qatif area of Saudi Arabia’s Eastern Province.