3C-INT | [Cyber]Crime Characterization for Intelligence

Ghilan Legion

ID: ff20179e727ef657f8a7e08df67fae3e26825

Hacktivist Group Hacktivism

Threat types: Intrusion

Unknown KHM, DNK, SAU, SDN, UKR, ARE

Updated: 2026-03-14

Created: 2025-10-23

Progress: 85% Completeness: 92% Freshness: 70%

Operation zone: Cambodia, Denmark, Saudi Arabia, Sudan, Ukraine, United Arab Emirates

Aliases Limited alias preview

GhilanLegion

GhilanLegion Team

TE*****

—

Showing 2 of 3 aliases in free preview.

Associated Threat Relationships

Limited preview

Related profiles 6
Related files 0

Related profiles

ID	Threat	Origin	Type	Categories
bc245f4663e20bad7d80595fc6306f8133384	Bangladesh Cyber Troops	Bangladesh	affiliated	Hacktivist Group
4bb2d96e1a971d2acbb402a93a3bf5bc40897	KAL EGY 319	Egypt	affiliated	Cybercrime
78dd1c3c3dfc6fcbbda95d743ab0e2f732121	NoName057(16)	Russia	affiliated	Hacktivist Group
fc5969f3e43afe21e7435fae2a663d5365150	Red eye of Palestine	Palestine	affiliated	Hacktivist Group
6414480505a9607a699363d9310b6ca358769	Red Wolf Cyber Team	Iran	ally-of	Hacktivist Group
9a77b58f31cb1001046836fd034c6d9a84092	ToxicJ	Unknown	affiliated	Cybercrime

Related files

No related files found.

Actor Network Graph

Open Network Graph

Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.

MITRE ATT&CK®

confidence: medium

Actor Techniques page ATT&CK® Diagram

Ghilan Legion is an OSINT-visible hacktivist brand primarily associated with DDoS/DoS disruption claims against public-facing government and institutional websites and with rapid claim amplification using proof artifacts. Reporting in 2025 describes claims targeting Indian government and academic websites and notes a reported alliance announcement with 'NoName' (coalition signaling).

Technique	Technique name	Tactics	Evidence
T1585	Establish Accounts	TA0042	2025-10-20 — Public claim amplification via social platforms is central to the actor model; reporting cites Ghilan Legion claims and reposts. · ref
T1498	Network Denial of Service	TA0040	2025-10-20 — Reporting describes DDoS attacks claimed by Ghilan Legion against Indian government and academic websites. · ref
T1595	Active Scanning	TA0043	2025-10-20 — INFERENCE (confidence: medium): opportunistic discovery/selection of public-facing targets is implied by the described targeting of public portals and institutions. · ref

Strategic Intelligence

Limited preview

Last updated: 2026-03-15T00:37:00+00:00

Preliminary Strategic Intelligence

Ghilan Legion — Hacktivist brand (disruption/DoS + claim amplification; coalition-aligned)

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Full strategic intelligence is available in Analyst and Premium plans.

Executive Analyst Brief for CISO

Saved Limited preview

Executive Analyst Brief for Decision Makers — Ghilan Legion

Classification: Unclassified / OSINT — TLP:WHITE

Upgrade to access the full executive brief.

Tip: Hover the section title to learn what’s included in Analyst / Premium plans.

Saved successfully.

Hunting Playbook

Saved Limited preview

Hunting Playbook — Ghilan Legion (DDoS/DoS + claim amplification)

Goal: Detect and mitigate DDoS/DoS activity, quantify real impact vs claim noise, and catch opportunistic follow-on probing during disruption windows.

Upgrade to access the full hunting playbook.

Tip: Hover the section title to learn what’s included in Analyst / Premium plans.

Saved successfully.

IOC Appendix

Saved Limited preview

Last updated: 2026-03-15T00:39:19+00:00

IOC Appendix — Ghilan Legion

Classification: Unclassified / OSINT — TLP:WHITE

More IOC context for Research. Full appendix for Analyst and Premium plans.

Saved successfully.

OSINT Library

Saved Limited preview

Last saved: 2026-03-15T00:39:51+00:00

OSINT Library — Ghilan Legion

2025-10-20 — TechNadu — “DDoS Attacks Target Multiple Indian Government & Academic Websites”

Full OSINT references available for Research / Analyst.

Saved successfully.

Social Medial & Communication

SOCMINT integrated: 0/9

Twitter 1 0
Telegram 8 0

Address	Verification	SOCMINT
`x.com/ghi**********`	Restricted	Not integrated

Address	Verification	SOCMINT
`t.me/Ghi*********`	Restricted	Not integrated
`t.me/Ghi*************`	Restricted	Not integrated
`t.me/+A_**************`	Restricted	Not integrated
`t.me/Dar*******`	Restricted	Not integrated
`t.me/+Zb**************`	Restricted	Not integrated
`t.me/+EW**************`	Restricted	Not integrated
`t.me/Ghi**************`	Restricted	Not integrated
`t.me/Ghi****************`	Restricted	Not integrated