Grupo hacktivista

GORZ ROSTAM

Estado: Activo Confianza: Confirmado

GORZ ROSTAM is a publicly active 2026 hacktivist actor operating through t.me/GORZROSTAM313 and associated with anti-Israeli and pro-Iranian narratives. Independent reporting describes DDoS/disruption claims, website defacement and data-leak promotion, with Israel and regional financial-sector organizations among the most salient targets. Unlike a claim-only persona, GORZ ROSTAM has a recoverable defacement archive: DefacerID lists dozens of 2026 entries and selected 2026-07-07 incidents identify SQL Injection as the PoC. This supports actor-specific T1190 and T1491.002. DDoS is also independently reported as a recurring modality, but individual claimed outages vary in corroboration. The actor real-world origin is not established by this evidence and is not inferred from ideology, language or the numeric identifier 313.

Creado por iQBlack CTI Team

Colaboradores 1

Última actualización 2026-09-07

ATT&CK

MITRE ATT&CK

T1190Exploit Public-Facing Application

T1491.002External Defacement

T1498Network Denial of Service

Research

OSINT seleccionado

Global Cyber Threat Briefing: June 2026Thomas Murray Cyber Attack Report #307789 — SITE123 pageDefacerID Cyber Attack Report #281060 — euroline.co.ilDefacerID Security Issues in the Korean & Global Financial Sector in July 2026AhnLab ASEC GORZ ROSTAM team archiveDefacerID