Rebel Jackal

Executive Summary

Rebel Jackal, also known as FallagaTeam, is a pro-Islamist hacktivist group primarily targeting sectors and countries perceived as antagonistic to Muslim interests. Known for website defacements and the use of a custom RAT (Fallaga RAT) based on njRAT, this group leverages basic malware capabilities to further its ideological goals.

Goals & Targeting

Rebel Jackal’s strategic objectives appear to be driven by a desire to defend perceived Muslim interests and retaliate against real or perceived injustices. The group targets sectors and countries aligned with Western policies or those it deems hostile to Islamic causes, including government agencies, financial institutions, and media outlets. Its primary motivation centers on ideological grievances, and its targeting profile reflects efforts to impact entities with significant public exposure or symbolic importance in the context of Muslim communities.

Rebel Jackal is an emerging pro-Islamist hacktivist group that combines traditional cyberactivism with limited malware development. The group’s primary activities include website defacements, which serve as a tool for political expression in response to perceived injustices against the Muslim ummah. While their operational scope appears relatively narrow compared to other hacktivist groups, Rebel Jackal has demonstrated some technical sophistication through the development of Fallaga RAT—a modified version of njRAT, a widely used malware framework in the Middle East/North Africa (MENA) region. The group’s targeting strategy reflects its ideological priorities, focusing on entities it perceives as threats to Islamic communities. Rebel Jackal's activities are likely influenced by broader hacktivist trends and geopolitical dynamics in regions with significant Muslim populations.

Key Capabilities

• Website defacements
• Development and deployment of custom RAT (Fallaga RAT)
• Basic malware capabilities based on njRAT framework
• Limited persistence and lateral movement techniques

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Rebel Jackal appears to operate with periodic campaigns, often triggered by specific geopolitical events or perceived slights against Muslim communities. The group’s victims are typically high-profile entities in sectors such as government, finance, and media. Notable operations include a series of defacements targeting entities associated with Western interests. While the group’s operational tempo is not consistently high, its involvement in campaigns suggests that it is a persistent but relatively low-sophistication threat actor in the hacktivist space.

IOC Patterns

• Website defacement activities (overwriting websites with politically charged messages)
• Presence of njRAT-based malware on targeted systems
• Use of web shells for initial access and lateral movement
• Signs of fileless or in-memory payloads used for persistence

Recommended Actions

• Implement multi-factor authentication (MFA) for critical accounts and systems
• Monitor for unusual network activity, particularly during periods of heightened geopolitical tension
• Conduct regular code signing verification to detect malicious binaries
• Apply patches and updates to websites to prevent defacement attempts

Suggested Tags