SYLHET GANG-SG

Executive Summary

Sylhet Gang‑SG, a pro‑Palestinian hacktivist collective linked to Iranian state actors, executes large‑scale DDoS campaigns and destructive wiper malware against critical infrastructure and foreign governments perceived as allies of Israel. Their operations blend politically motivated messaging with technical sabotage, targeting a wide range of sectors including defense, finance, healthcare, telecoms, energy, and industry worldwide. The group’s rapid escalation from symbolic attacks to supply‑chain disruption underscores the significant operational tempo and evolving threat surface.

Goals & Targeting

The primary strategic objective of Sylhet Gang‑SG is political disruption aimed at undermining support for Israel and its Western allies. By targeting government, defense, energy, finance, healthcare, telecoms and industrial sectors across a broad geographic span – including the U.S., UAE, Bahrain, Jordan, Kuwait, Romania, Saudi Arabia, Iran, Israel, Pakistan, India, and Greece – the group seeks to showcase geopolitical grievances through economic and operational sabotage. Their typical victims include state agencies, critical infrastructure operators, large multinational corporations, and any entity that can be positioned as a proxy for Israeli policy. The campaign’s narrative framing and public post‑attack disclosures are designed to galvanize sympathizers and pressure affected entities to reconsider alliances.

Key Capabilities

• Large-scale Distributed Denial‑of‑Service (DDoS) campaigns
• Custom wiper malware (Hatef, Hamsa) capable of full system wipe
• Stealthy backdoor delivery (Dindoor Deno runtime, Fakeset Python)
• Credential exploitation via spear‑phishing and dark‑web leaks
• Lateral movement through administrative tool hijacking (Microsoft Intune, remote factory resets)
• Defacement and data leak operations on Telegram and dark‑web channels
• Targeted attacks against OT/ICS equipment (Rockwell Automation, Allen‑Bradley PLCs)

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Sylhet Gang‑SG demonstrates a pronounced operational tempo, rapidly scaling from symbolic defacement to supply‑chain disruption over a matter of days. Their attack patterns reveal a preference for exploiting current geopolitical events – for instance, capitalizing on the 2024 CrowdStrike outage – and targeting nations aligned with Israel. Notable past operations include large‑scale DDoS assaults on the Port of Los Angeles and various UAE governmental portals in late February 2026, as well as destructive malware campaigns against the medical technology firm Stryker in March 2026 and attacks on Rockwell Automation PLCs attributed to the cluster CL‑STA‑1128. The group’s methodology leverages legitimate credentials when available, sophisticated botnet orchestration for DDoS, and custom-built malwares that combine backdoor persistence with destructive payloads. Their alignment with other Iranian‑affiliated cells (e.g., Handala, DarkStorm) indicates a collaborative ecosystem aimed at maintaining plausible deniability while maximizing impact.

IOC Patterns

• Spearfishing emails bearing malicious attachments or links tied to domains such as trumpvsirancoin.xyz or emiratesinvestunion.com
• Large‑volume outbound DNS traffic originating from previously unseen IP ranges used for DDoS amplification
• Executable binaries with names like hatef.exe, hamsa.sh, dindoor.dll exhibiting SHA‑256 hashes identical to those observed in the cluster
• Unusual PowerShell execution chains targeting remote machine management tools (Microsoft Intune)
• Outbound HTTP/HTTPS traffic toward dark‑web drop‑points or Telegram API endpoints for data exfiltration

Recommended Actions

• Implement mandatory multi‑factor authentication, especially on privileged and administrative accounts; enforce strong password hygiene and monitor for credential reuse across services.
• Deploy advanced DDoS mitigation solutions and set threshold alerts for sudden traffic surges that deviate from typical baselines.
• Enable PowerShell logging with execution validation to detect anomalous use or lateral movement techniques.
• Implement web filtering and endpoint detection to block spear‑phishing attachments and suspicious URLs; conduct regular phishing simulation training.
• Maintain isolated, redundant backups of critical systems and verify integrity of backup data via hash checks and offline storage to counter wiper attacks.
• Introduce network segmentation between corporate LAN and OT/ICS infrastructure, enforce least privilege on PLC access, and implement stringent monitoring for unauthorized configuration changes or remote reset commands.
• Apply timely patches for known vulnerabilities in operational tools such as Microsoft Intune, Cisco AnyConnect, and relevant OT protocols; conduct periodic vulnerability scanning of all critical assets.
• Establish incident response playbooks that include containment procedures for backdoor execution (Dindoor, Fakeset) and immediate system isolation following detection of destructive malware signatures.

Suggested Tags