313 Team

Executive Summary

313 Team, also known by names such as Islamic Cyber Resistance and DarkStorm, is a pro‑Iranian threat actor that blends hack‑and‑leak tactics with political defacement and destructive wiper campaigns. The group frequently launches high‑volume DDoS attacks against government portals, followed by spear‑phishing or credential harvesting to gain valid accounts and deploy custom malware. Publicly claiming responsibility through Telegram, it demands cryptocurrency payments for cessation of its disruptive operations.

Goals & Targeting

313 Team seeks disruption of political stakeholders aligned at odds with Iranian interests, primarily targeting state, defense, financial, healthcare, energy, telecommunications, media, and critical infrastructure sectors across the Middle East, U.S., Russia, and other regions. The group blends sabotage—via DDoS or wiper deployments—with propaganda, executing defacement campaigns that embed coalition imagery to elevate political messaging. By acquiring valid credentials through spear‑phishing or leaked data, the actor gains persistence within corporate environments, facilitating future destructive operations or information exfiltration from compromised cloud services and IoT devices.

Key Capabilities

• Spearfishing‑based initial access leveraging legitimate accounts
• Lateral movement via Microsoft Intune factory reset on corporate PCs
• Custom wiper malware deployment (Hatef for Windows, Hamsa for Linux)
• Persistent backdoor implants (Dindoor in Deno, Fakeset in Python)
• Large‑scale volumetric DDoS attacks against government portals and cloud services
• Supply‑chain compromise of Trivy Docker images and GitHub releases to deploy backdoors
• Industrial Control System exploitation including PLC manipulation and Hikvision camera abuse for recon
• Web site defacement with political branding using coalition imagery
• Infrastructure provisioned via commercial cloud storage (Wasabi, Backblaze) with Rclone-based data exfiltration
• Telegram‑based command & control channels

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

313 Team’s campaigns exhibit a rapid, high‑tempo pattern closely tied to geopolitical events. The actor publicly boasts successes on Telegram and demands cryptocurrency ransoms for campaign cessation. In addition to disruptive DDoS blasts against political targets, the group deploys wiper malware after initial infiltration or as a secondary destructive measure. Supply‑chain exploitation—particularly tampering with public Docker images and GitHub releases—and persistence via backdoor implants indicate an evolution toward more sustained footholds, while its foray into PLC manipulation signals potential future attacks on industrial control systems.

IOC Patterns

• domain
• url

Recommended Actions

• Implement and harden anti‑DDoS solutions across critical infrastructure and public-facing services.
• Enhance security awareness training and MFA to mitigate spear‑phishing targeting valid credentials.
• Deploy monitoring for unusual Intune or MDM factory‑reset commands and enforce least privilege policies on corporate devices.
• Patch known vulnerabilities in industrial systems (e.g., Hikvision cameras) and segment PLC networks from general IT traffic.
• Detect and block custom wiper binaries (Hatef, Hamsa) and backdoor implants using EDR correlation of file hashes.
• Block or quarantine traffic to Telegram bot C2 infrastructure; restrict outbound access to known Telegram endpoints where feasible.
• Apply supply‑chain controls: verify Docker image hashes, lock container registries, and monitor GitHub release integrity.
• Monitor for anomalous Rclone activity to commercial cloud platforms (Wasabi, Backblaze) that may indicate exfiltration.
• Follow CISA guidance on destructive malware detection and apply hardening guidelines from ST10‑001.
• Maintain a catalog of known domains associated with the group’s operations and use threat intelligence feeds to block them preemptively.

Suggested Tags