Attribution
Pro-Palestinian / anti-Israel hacktivist collective that publicly presents as an independent group aligned with the Hamas 'Toufan Al-Aqsa' (Al-Aqsa Flood) framing. Multiple vendors (Check Point, Cybernews, SOCRadar, Recorded Future/The Record) assess a probable Iran nexus based on operational scale, timing, target selection, and wiper tradecraft, but the group has not confirmed its origins and the state-sponsorship link is an assessment, not a confirmed fact. Attribution should be treated as unconfirmed/medium-confidence for the Iran nexus and high-confidence only for the pro-Palestinian hacktivist positioning.
Sectors
Government, defense, finance, retail, healthcare, hosting/critical infrastructure