Cyber Al-Hreah Team

Cyber Al-Hreah Team, also appearing as Al-hreah team, is an Iraqi hacktivist/intrusion-claim group centered on Telegram @[redacted]. The channel profile carries explicitly Iraq-nationalist messaging, and archived posts include retaliatory language toward Gulf states or countries described as hostile to Iraq. Public material also indicates an internal transition: a figure referred to as “Jon” announced retirement/account deletion and stated that the channel would pass to a “right hand” associated with @[redacted], while @[redacted] and @[redacted] appeared in the handoff context.

Operationally, the group has published or been relayed in connection with high-impact claims. One channel post linked a purported breach of Kuwaiti Ministry of Defense systems to retaliation for an incident involving Iraqi fishermen. Separately, a public relay attributed to the persona Jondata1 claimed Al-Hreah Team compromised surveillance/data systems at an unnamed Iranian nuclear facility through an employee, gained access to approximately 60 cameras and about 800 GB of recordings/data, and paid the employee $200. These claims are not independently validated.

INFERENCE (confidence: high): The actor's public identity is materially tied to Iraqi nationalist/retaliatory framing rather than purely financial motivation.

INFERENCE (confidence: medium): The visible handoff from Jon to @[redacted] indicates an organizational continuity mechanism even if the retiring persona deletes accounts; future claims should be evaluated for changes in tone, targeting and technical credibility after the succession.

INFERENCE (confidence: low): A stylized S-Root1 identity appears in channel-attraction metadata in May 2026, but this is insufficient to link the group operationally to the separately tracked BYTE GHOST/S-ROOT persona.