Holy League in the geopolitics of hacktivism and hybrid conflict

Holy League did not enter the scene as just another name in the noise of geopolitical hacktivism. From the outset, it appeared to be trying to form a union rather than position itself as a closed group built around its own brand. In doing so, it turned itself into a meeting point for teams, causes and narratives that already existed separately, but that could begin to recognise one another under a shared hostile front against Israel and its allies.

This reading is also supported by public reporting from cyber security companies. Radware described Holy League as an alliance formed out of the union between High Society and 7 October Union, with a discourse aimed at bringing together pro-Russian and pro-Palestinian hacktivists against Western countries, India and states backing Ukraine and Israel. Cyble, in its analysis of the campaign targeting France in December 2024, also treated it as an alliance and distinguished between attacks coordinated by the front and operations carried out by individual members, including DDoS attacks, defacements, data leak claims and even allegations of industrial system compromise by actors in the Holy League orbit. ENISA, for its part, included Holy League alongside 7 October Union among the alliances that contributed to the increased pace and intensity of DDoS attacks against European public administrations.

Examples of digital propaganda linked to Holy League, used to amplify campaigns against European targets and reinforce the image of a coordinated front beyond any single attack.

That is why reading Holy League through the classic lens of a hacktivist group quickly starts to feel incomplete. Asking only what it attacked or which operations were tied to its name captures part of the phenomenon, but leaves aside the more interesting question of how Holy League gained relevance within the anti-Israel ecosystem.

In a previous article, we examined how certain pro-Iranian and pro-Russian spaces were beginning to overlap within the same terrain of digital hostility. Holy League matters because it adds something to that overlap: an attempt to give shape to the convergence and offer it a shared stage.

From that perspective, it looks less like a singular technical actor and more like a coalition architecture whose value seems to have rested, and in part may still rest, in bringing together groups and sympathisers under a common logic, allowing them to see themselves as participating in the same confrontation even without a closed structure or a clearly defined chain of command.

That logic is not unusual in contemporary ideological hacktivism. In a recent analysis for The Global Network on Extremism and Technology, researcher Sonja Belkin argued that these environments often operate through loose structures, informal hierarchies and different levels of involvement, where visible propaganda, grievance-based narratives and accessible action templates help both recruit and amplify campaigns. She also warns that sensationalist coverage of unverified attacks can artificially inflate perceptions of effectiveness around such actors.

When, in a 2024 statement published through one of its official Telegram channels, Holy League spoke of a union of more than eighty hacktivist teams and called for opening all fronts against Israel and its allies, it was doing more than using the language of attack. There was something closer to a bloc-building appeal, even a form of political militancy. References to Palestine, Hezbollah, Russia and China, combined with a tone of total confrontation, made it clear that Holy League was not trying to speak to a single ecosystem. It was trying to construct common ground for different actors whose causes were not identical, but were compatible around shared enemies.

The following graphic helps illustrate something that Holy League’s public discourse had already suggested from the beginning: its weight does not seem to have rested in a compact technical identity, but in its ability to function as an articulating node between more active actors, satellite alliances and second-degree links. The coloured connections highlight the most visible or active relationships today, while the faded ones point to peripheral or lower-intensity ties that help explain the front’s relational volume without mistaking it for a fully closed hierarchy.

Holy League as an articulating node: active links highlighted in colour, second-degree relationships shown in the background.

This is where the case begins to say more than the sum of its attacks. In hybrid conflicts like this one, what is at stake is not only technical access or operational capability. It is also the ability to gather dispersed identities, fix common targets, generate a sense of scale and turn fragmented campaigns into the image of a coordinated force.

According to the evidence available, Holy League’s role was not limited to claiming attacks. It also functioned as a useful piece in staging a broader confrontation in which representation has operational value and propaganda forms an active part of the cause. Visible coordination, even when it does not amount to a rigid hierarchy, can produce political, psychological and reputational effects that are often wider than the concrete technical damage of any individual episode.

The combination it brought together also helps explain why it drew attention. Pro-Islamist circuits contributed cause, a language of resistance, the centrality of Palestine and a militant epic that hardly needs explanation inside that universe. Pro-Russian environments, meanwhile, were already more accustomed to frequent digital pressure campaigns, anti-NATO narratives and distributed forms of harassment against Western targets.

Holy League’s visual rhetoric was not limited to Israel. It also incorporated hostility toward NATO as part of a broader front narrative.

From there, the geopolitical value of the case becomes clearer. What was being built was not simply a sum of groups, but a form of warlike representation adapted to the digital sphere and still relevant today. That helps explain why the front’s core message seemed less concerned with demonstrating technical skill than with producing alignment, adhesion and meaning. Some attacks, taken in isolation, may have had uneven or even limited impact. Yet in terms of bloc-building, resistance narrative and symbolic projection, Holy League helped install the image of a constellation seeking to act as a shared front.

The picture becomes even more interesting when looking at what happened afterwards. Today, Holy League no longer appears to hold the same visibility it once did, but that does not necessarily mean disappearance. Internal analysis of several of its distribution channels suggests a shift toward the orbit of Cyber Islamic Resistance, also known as CIR. The channel that began as “Holy League” gradually changed, forwarding CIR content, spreading propaganda, publishing recruitment messages, calling for financial support and pointing followers toward official accounts tied to that new centre of gravity.

That movement is not enough to close the hierarchical map, but it does support a more sober and useful hypothesis: Holy League’s role was recycled or reordered within a more active ecosystem in which Cyber Islamic Resistance and Abu Omar now carry greater visibility. In that circuit, some groups weaken, others are repurposed and others disappear, yet the strategic need that made them useful may remain intact. In this case, everything suggests that the front logic is still present, even if it no longer depends exclusively on the old Holy League label.

It is still worth keeping a cold head. The opacity remains high. It is not clear how stable any hierarchy really was, nor how much of the front’s self-proclaimed volume reflected genuinely integrated capability. What does appear more clearly is something else: an opportunistic, ideologically charged coalition heavily dependent on narrative, one that found in this space a fertile ground for giving political form to a convergence that had previously appeared in a more dispersed way.

In that sense, Holy League matters less as a compact actor than as a case study in how certain hacktivist coalitions try to produce front, legitimacy and coordination within a hybrid conflict.

Methodological note: This article was developed using internal profiling inputs produced in 3C-INT on Holy League, along with analysis of the actor’s public channels.