313 TeamThreat actor
313 Team is an Iraq-based threat actor that has conducted coordinated DDoS campaigns targeting multiple government servers in the UAE, Kuwait, and Romania, often in response to political statements. They have claimed responsibility for significant disruptions, including a one-hour shutdown of Romania’s National Tax Agency and an 18-hour outage of Kuwait's national e-government portal.From MISP Galaxy
Last reported 12 days ago, by Security Affairs3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1036Masquerading
“Attributed to threat actor idbzoomh, the campaign used a malicious archive masquerading as leaked source code to deliver Vidar v18.7, an information stealer, and GhostSocks, a SOCKS proxy trojan.”
- T1195Supply Chain Compromise
“On April 25, a supply-chain compromise reportedly targeted the elementary-data project, where a forged release was published to PyPI and a matching trojanised container image was pushed to the GitHub Container Registry.”
- T1555.005Password Managers
“The campaign impersonated legitimate developer tooling to deliver RAT-enabled infostealers targeting credentials, browser data, password managers, and cryptocurrency wallets.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Canonical Hit by Second DDoS Attack in 2026, Public Websites Disrupted“At the time, a hacktivist group called The Islamic Cyber Resistance in Iraq, also known as 313 Team, claimed responsibility.”
-
Canonical Websites Disrupted in Second DDoS Attack This Year“A hacktivist group calling itself The Islamic Cyber Resistance in Iraq – 313 Team claimed responsibility for that attack.”
-
Cyber Brief 26-05 - April 2026“…d threat actors had been targeting internet-exposed programmable logic controllers across US critical infrastructure, while Iran-linked 313 Team claimed responsibility for a DDoS attack against social media platform Bluesky.”
Indicators in its reports
named in the reports aboveCopy these 2 indicators · defanged
Thanks — we review every report.