GINC-APT-0632 · Hacktivist

Altahrea Team

Category: Hacktivist · Political or nationalist, often disruption and leaks.
Origin: Iraq(high confidence)
Sources: 3 sources carry it
Identifier: GINC-APT-0632 · altahrea-team

What it is

Altahrea Team is a pro-Iranian hacking group that has been active since at least 2020. The group has claimed responsibility for a number of cyberattacks, including DDoS attacks against Israeli websites, a hack of the Israel Airports Authority website, and a cyberattack on the Orot Yosef power plant in Israel.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

MISP Galaxy (CFR tagging)Iraq
ThreatActor.info (Malpedia et al.)Iraq

Tools

The tools and malware families the sources tie to it.

Cyber Eye RAT
CyberGate
Hacking Team UEFI Rootkit
POWERSOURCE
POWERSTATS
Power Loader
PowerDuke
PowerRAT

Sources

Malpedia malpedia.caad.fkie.fraunhofer.de