- Category
- Hacktivist · Political or nationalist, often disruption and leaks.
- Origin
- Unknown
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-1094 · zeffsec
What it is
ZeffSec is a hacktivist collective focused on infrastructure-level disruption and exposing vulnerabilities in centralized digital networks. In March 2026, the group claimed responsibility for a large-scale DDoS attack against ArvanCloud, Iran's primary cloud and CDN provider, causing widespread service outages across platforms including the online education service Skyroom. The group announced the operation via Telegram, stating their goal was disruption of centralized infrastructure rather than data theft.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Zeff Security
Tools
The tools and malware families the sources tie to it.
- CloudDuke
- CrossRat
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de