Threat Actor Characterization
Soldiers of Solomon
ID: c10849ad18c502e24aa0deb1e72ea8d450069| SoldiersOfSolomon | — | — | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
7c315ae04cc0a2b782796bd39b7fe96e83203 | Crucio | Iran | related | Crimeware |
|
2833df69906a2ea5d05283ca4f837bd432121 | CyberAv3ngers | Iran | related | Cybercrime |
|
d9d80d03cfe271e7a52c9a8768b0178c82621 | Islamic Revolutionary Guard Corps Cyber | Iran | ally-of | Cybercrime |
|
c81f42761d1b53a2d875a33ddfb8cdb764758 | Milad Mansuri | Iran | related | Cybercrime |
|
8e1b51115cf9f23a27dc1e40755faace18409 | Reza Mohammad Amin Saberian | Iran | related | Cybercrime |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Soldiers of Solomon is a pro-Iran, anti-Israel cyber persona publicly associated with CyberAv3ngers / Storm-0784. Public reporting suggests it functioned primarily as a hack-and-leak and influence-amplification brand rather than a clearly independent advanced intrusion group.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1078.001 | Default Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1491.001 | Internal Defacement | TA0040 |
|
| T1565.001 | Stored Data Manipulation | TA0040 |
|
| T0822 | External Remote Services | TA0108 |
|
| T0814 | Denial of Service | TA0107 |
|
Classification: TLP:WHITE — Cyber / Hybrid Hacktivist Persona / Suspected State-Linked Proxy Brand
Author: iQBlack CTI Team
Executive Summary
Soldiers of Solomon is best assessed as a pro-Palestinian, pro-Iran cyber persona publicly associated with the broader CyberAv3ngers / Storm-0784 ecosystem rather than a clearly independent threat actor. Public reporting links the brand to Iran’s Islamic Revolutionary Guard Corps (IRGC)-aligned operations targeting Israeli interests during and after the opening phase of the Israel–Hamas war in October 2023.
The persona’s activity pattern centers on hack-and-leak claims, webcam and server compromise claims, industrial/distribution-themed disruption narratives, and aggressive propaganda amplification. Several public claims were later assessed as exaggerated, misleading, or demonstrably false, especially the claim that the actor had ransomed systems at Nevatim Air Force Base. This matters analytically because the persona appears designed not only to announce attacks but to amplify psychological pressure and create the perception of deeper compromise against Israeli infrastructure.
Hunting Playbook — Soldiers of Solomon
Priority: Medium-High for Israeli-affiliated organizations and operators of exposed cameras, HMIs, PLC-linked interfaces, and smart-facility systems.
IOC Appendix — Soldiers of Solomon
Scope & Caveats. This appendix is intentionally conservative. Public reporting around Soldiers of Solomon contains a high proportion of claim-driven material, and several headline claims were later assessed as false or exaggerated. Indicators below should therefore be treated primarily as hunting and context-enrichment artifacts, not as universal blocking rules.
