Hacktivism Watch: June 2026 — Top 10 Threat Actors & Global Targeting Trends

Executive Summary

This report profiles the top 10 hacktivist groups observed during June 2026, based on their operational activity and public attack claims, while analyzing their campaigns and evolution from 2023 to mid-2026. Most rely on DDoS attacks, website defacement, and Telegram to disrupt services, claim attacks, and amplify visibility. Four groups UNiT313, 404 Cyber Crew, GORZ ROSTAM, and Elite Squad demonstrate more advanced capabilities, including wiper malware, infostealers, extortion, and credential leaks. Government organizations are the primary targets, followed by finance, telecommunications, healthcare, and education, with Israel and Thailand emerging as the most targeted countries. Overall, these groups prioritize disruption, publicity, and psychological impact over long-term network persistence or espionage.

Introduction

Hacktivist collectives have become a persistent and increasingly organized layer of the global threat landscape, blending ideological messaging with disruptive cyber operations. Unlike financially motivated ransomware crews or state-sponsored espionage units, hacktivist groups prioritize public visibility  claiming attacks openly, publishing proof of impact, and using Telegram and dark web channels as both coordination hubs and propaganda platforms.

This report consolidates intelligence on ten such actors tracked through mid-2026: Dark Storm Team, BD Anonymous, RipperSec, Yemen Cyber Group, UNiT313, 404 Cyber Crew, Elite Squad, GORZ ROSTAM, NXBB.SEC, and ZxS3C. Each profile follows a consistent structure  Overview, Tools Used, Targeted Sectors, Targeted Countries, Telegram Channels & Communication, Disruption Activity, and Alerts  to support consistent comparison across actors. Profiles draw on Telegram channel monitoring, dark web forum activity, outage-validation evidence (Check-Host and similar platforms).

The purpose of this report is threefold: to document each group's current tactics, targeting patterns, and infrastructure; to identify overlaps and escalation trends across the broader hacktivist ecosystem; and to translate these findings into practical detection and hardening recommendations for defenders in the government, financial, telecommunications, and critical infrastructure sectors most frequently named.

Threat Actor: Dark Storm Team

Overview

Dark Storm Team is a publicly active hacktivist actor first observed in August 2023, primarily associated with Distributed Denial-of-Service (DDoS) campaigns against government organizations, critical infrastructure, and high-profile public services worldwide. It operates openly through Telegram, claiming responsibility for attacks and publishing operational updates. Its operations are disruption-focused and frequently align with geopolitical events, prioritizing publicity over long-term network access.

Tools Used

Evidence indicates that Dark Storm Team's operations center on DDoS campaigns, supported by commercial DDoS-for-hire offerings advertised through its Telegram channel. The group also advertises database dumping services and uses Check-Host availability reports to substantiate claimed attacks. No publicly available evidence identifies the underlying DDoS framework, botnet, or attack software, and no confirmed use of custom malware or sophisticated post-exploitation toolsets has been observed

Targeted Sectors

(OBSERVED DATA 2023 TO 2026)

Government and public-sector organizations ministries, municipalities, law enforcement, defense, and public administration are the clear preference, with additional targeting of transportation/aviation, financial services, telecommunications, energy and utilities, healthcare, education, and technology.

Targeted Countries

(OBSERVED DATA 2023 TO 2026)                                                                             

The United States is targeted most frequently by a significant margin, followed by Israel, Poland, Germany, Finland, Ukraine, and the United Kingdom. The distribution suggests a preference for geopolitically significant nations with advanced digital infrastructure.

Telegram Channels & Communication

The group's primary channel (t[.]me/Darkstormteam22) is used to announce attacks, publish updates, and share outage evidence, screenshots, and target announcements reinforcing credibility and amplifying visibility and psychological impact.

Disruption Activity & Alerts

Dark Storm Team conducts coordinated DDoS campaigns targeting government agencies, critical infrastructure, financial institutions, transportation, telecommunications, healthcare, education, and technology sectors to disrupt services and amplify geopolitical messaging. Since August 2023, the group has claimed attacks across Israel, France, Germany, Spain, Ukraine, the UAE, Egypt, Turkey, Brazil, the Czech Republic, Argentina, the United States, and other NATO-aligned countries, as well as major platforms including X, YouTube, and Facebook, demonstrating sustained high-visibility operations through 2026.

Threat Actor: BD Anonymous

Overview

BD Anonymous is a hacktivist actor first observed in January 2025, primarily conducting DDoS operations against government entities, financial institutions, telecommunications providers, educational organizations, and critical infrastructure. It publicly claims attacks through Telegram and aligns its operations with pro-Palestinian messaging, targeting organizations associated with Israel and its allies. 

Tools Used

BD Anonymous primarily conducts Distributed Denial-of-Service (DDoS) attacks against publicly accessible web services. Publicly available evidence indicates the group relies on DDoS infrastructure and outage verification services (e.g., Check-Host) to validate claimed disruptions; however, no verified evidence identifies the specific DDoS tools, malware, botnet family, or attack framework used in its operations. 

Targeted Sectors

(OBSERVED DATA 2025 TO 2026)

Government and public administration organizations account for the largest share of victims, with significant interest also shown in private businesses, manufacturing, IT services, aviation/aerospace/defense, non-profits, transportation and logistics, banking and financial services, education, and media.

Targeted Countries

(OBSERVED DATA 2025 TO 2026)

Israel is the most heavily targeted country by a substantial margin. Other frequently targeted countries include India, Thailand, Taiwan, South Korea, the United Kingdom, and Ukraine, with additional activity across Europe, the Middle East, and Asia-Pacific.

Telegram Channels & Communication

The group's public channel (t[.]me/httpstmeVI8Cr1np5kxhyjd5) is used to announce attacks, publish updates, and share evidence of disruptions, alongside ideological messaging and campaign hashtags aimed at building visibility within hacktivist communities.

Disruption Activity & Alerts

The group conducts coordinated DDoS campaigns primarily targeting government, military/defense, financial, telecommunications, and educational organizations, occasionally accompanied by website defacements and data leaks to amplify ideological messaging. Between September 2025 and March 2026, the group claimed attacks against organizations in South Korea, Israel, Australia, and Nepal, including intelligence agencies, the Investment Board Nepal, and XPHONE 018 LTD. The repeated targeting of South Korea and Australia indicates sustained campaigns rather than isolated incidents.

Threat Actor: RipperSec

Overview

RipperSec is a publicly active hacktivist actor first observed in June 2023, primarily associated with DDoS attacks against government organizations, critical infrastructure, educational institutions, financial services, and public-facing websites. It maintains an active Telegram presence and supports pro-Palestinian narratives through high-profile cyber operations.

Tools Used

The group employs DDoS attack frameworks including the ANVIL v1.0 Cybersecurity Load Testing Framework and MegaMedusa DDoS, allowing configuration of HTTP methods, request rates, concurrency, and duration. Check-Host is used to validate outages before publishing results via Telegram.

Targeted Sectors

(OBSERVED DATA 2023 TO 2026)

Government and public administration represent the largest proportion of victims, followed by education and research, private businesses/IT services, non-profit and civic organizations, banking and financial services, healthcare, aviation and defense, media, transportation, and energy.

Targeted Countries

(OBSERVED DATA 2023 TO 2026) 

Israel is the primary focus by a considerable margin. Other frequently targeted countries include India, Thailand, Taiwan, South Korea, France, Australia, the United Kingdom, and Ukraine, spanning Europe, the Middle East, and Asia-Pacific.

Telegram Channels & Communication

RipperSec's channel (t[.]me/RipperSecDirect) serves as both a communication hub and promotional platform, sharing DDoS tool screenshots, Check-Host results, and target announcements to reinforce credibility and visibility.

Disruption Activity & Alerts

The group conducts high-volume DDoS campaigns targeting government agencies, critical infrastructure, financial institutions, education, telecommunications, healthcare, media, and technology sectors, typically followed by public claims and independent outage validation rather than persistent intrusion or data theft. Between August 2024 and June 2026, the group claimed attacks against organizations in Malaysia, the UAE, South Korea, India, Slovakia, Austria, France, and Palestine, including SCADA systems, telecom providers, technology companies, and AI-related services, while also alleging data leaks involving multiple Indian organizations, indicating activity extending beyond service disruption.

Threat Actor: Yemen Cyber Group

Overview

Yemen Cyber Group is a publicly active hacktivist actor primarily conducting disruption-focused operations against Israeli organizations. It maintains an active Telegram presence announcing campaigns and promoting ideological messaging supporting Palestine, focusing on publicly accessible organizations rather than advanced intrusions.

Tools Used

The group primarily employs Distributed Denial-of-Service (DDoS) attacks against public-facing websites, using high-volume traffic to disrupt online services. Operations are publicly announced through Telegram and are frequently supported by website outage screenshots and third-party availability checks (e.g., Check-Host) to reinforce attack claims. There is no public evidence indicating the use of custom malware, ransomware, credential-stealing tools, or long-term persistence frameworks.

Targeted Sectors

(OBSERVED DATA 2023 TO 2026)

Targeting favors Information Technology, Healthcare, Construction & Real Estate, Telecommunications, Legal Services, Retail, Hospitality, Non-Profit Organizations, and Publishing — organizations providing public-facing services or supporting national infrastructure.

Targeted Countries

(OBSERVED DATA 2023 TO 2026)                                                                        

Israel is the primary target, with additional activity identified in France, Germany, and the United States. The concentration on Israeli victims suggests a geopolitically driven campaign, with other activity appearing limited and opportunistic.

Telegram Channels & Communication

The group's channel (t[.]me/yemencybergroup) announces campaigns, shares ideological messaging, and publishes statements, with posts commonly containing target announcements and propaganda to reinforce its presence within hacktivist communities.

Disruption Activity

DDoS campaigns target public-facing organizations across healthcare, IT, telecom, real estate, legal services, retail, hospitality, and non-profit sectors, emphasizing visibility and ideological messaging over data theft or persistent access. 

Threat Actor: UNiT313

Also known as: 313 Team / Islamic Cyber Resistance 

Overview

UNiT313, also known as the 313 Team or Islamic Cyber Resistance, is a hacktivist collective with strong ties to Iran's Ministry of Intelligence and Security (MOIS). It positions itself within the pro-Palestinian, anti-Western "Resistance Axis," and while destructive intent predominates, recent operations have included extortion demands against multinational corporations and open-source infrastructure providers.

Tools Used

The group utilizes DDoSia Project for volunteer-driven distributed denial-of-service (DDoS) operations and references the Beamed network/service in its operational communications. The group also relies on custom-built DDoS tools, botnet-powered infrastructure, and commercial DDoS stressers/booters to conduct disruptive attacks. For communications, the group primarily uses Telegram for announcements and Session for private/extortion-related communications.

Targeted Sectors

(OBSERVED DATA 2023 TO 2026)

UNiT313 has targeted medical technology corporations, crippling manufacturing and R&D operations, and open-source technology providers such as Canonical — indicating a focus on critical infrastructure and widely used platforms for maximum visibility.

Targeted Countries

(OBSERVED DATA 2023 TO 2026)

Operations have impacted organizations in the United States, United Kingdom, and Saudi Arabia, with collateral effects spanning 79 countries due to the global reach of victims. Campaigns are often framed as retaliation against US and Israeli military actions.

Telegram Channels & Communication

UNiT313 maintains multiple Telegram channels(hxxps[://]t.me/xX313XxTeam/1351), sharing defacement screenshots framed with Quranic verses for religious legitimacy, and uses Session for extortion communications. Reliance on encrypted, anonymous platforms complicates attribution and law enforcement response.

Disruption Activity 

The group conducts DDoS attacks and website defacement campaigns targeting banking platforms, open-source services, and organizations aligned with Israel, Gulf states, and Western interests, aiming to cause service disruption, reputational damage, and amplify political messaging. Between December 2025 and March 2026, the group issued multiple claims of targeting Israel and announced a new "Space NeT" DDoS botnet project. However, the actor has a history of exaggerating its claims, and these alerts should be treated as indicators of intent rather than confirmed compromises, with no verified victims or IOCs publicly available.

Threat Actor: 404 Cyber Crew

Overview

The 404 Cyber Crew Team emerged as a hacktivist collective around 2025, operating as a coalition that has collaborated with entities including NullSec Nigeria and Infernalis under campaigns such as OpSouthAfrica. Its operations are politically motivated, tied to grievances such as xenophobia or anti-government sentiment, blending hacktivism with disruption over financial gain.

Tools Used

The group primarily employs botnet-backed Distributed Denial-of-Service (DDoS) attacks and website defacement scripts to disrupt public-facing services. Telegram activity shows recruitment of members with DDoS capabilities and coordination with allied hacktivist groups for joint operations; however, no specific DDoS toolkit or attack framework is publicly disclosed.

Targeted Sectors

(OBSERVED DATA 2025 TO 2026)

Government portals, financial institutions, telecom providers, and media outlets are the primary focus, with some attacks on critical infrastructure websites intended to maximize visibility and pressure authorities.

Targeted Countries

(OBSERVED DATA 2025 TO 2026) 

Operations span Europe, the Middle East, South Asia, and North America, with India and several EU nations reporting incidents during politically sensitive events, and the United States a frequent target of large-scale DDoS campaigns against corporate services.

Telegram Channels & Communication

The group maintains a Telegram (t[.]me/cybercrewagain/670) presence announcing attacks and sharing defacement screenshots, and also uses dark web forums and onion sites (frequently rotated) to recruit collaborators and publicize successful operations.

Disruption Activity & Alerts

The group conducts coordinated DDoS attacks that disrupt websites and online services for hours or days, frequently combined with website defacement campaigns displaying anti-government slogans, digital graffiti, and political propaganda to maximize visibility and media attention. Operating within the broader #OpIsrael-aligned hacktivist ecosystem alongside groups such as 313 Team and DarkStorm, the collective has also claimed a leak of approximately 120 Israeli passports and birth certificates, allegedly including Ministry of Defense-linked data. Recent alerts (25–26 June 2026) consist of claim-stage declarations targeting Jordan, Egypt, Morocco, Bahrain, the UAE, and Israel, reflecting ideologically driven targeting; however, no confirmed victims or technical IOCs have been identified, so these claims should be treated as unverified leads rather than confirmed compromises

Threat Actor: Elite Squad

Overview

Elite Squad is a hacktivist collective that has transitioned from small-scale opportunistic attacks to coordinated, large-scale disruption campaigns. In June 2026 it formally allied with DieNet, pooling infrastructure and personnel. Its ideological stance is strongly pro-Iran and anti-Western, prioritizing visibility and reputational damage over financial gain.

Tools Used

The group relies on shared botnet infrastructure for volumetric DDoS attacks, alongside open-source penetration testing tools, website defacement scripts, and credential-stuffing techniques. The group is also known to exploit publicly disclosed, unpatched vulnerabilities to gain initial access; however, there is no public evidence that it uses a proprietary exploit framework. References to the "Elite Arsenal" describe a researcher-defined set of commonly exploited CVEs rather than a tool or capability specific to the group.

Targeted Sectors

(OBSERVED DATA 2020 TO 2026)

Government portals, logistics networks, media organizations, and digital banking platforms are consistently targeted for their public visibility and critical role in national infrastructure.

Targeted Countries

(OBSERVED DATA 2020 TO 2026)

Campaigns have targeted the United States, Israel, and several European Union countries, reflecting the group's geopolitical alignment, with expansion into other regions where Western influence is strong.

Telegram Channels & Communication

Elite Squad maintains a presence on Telegram channels and underground forums to announce operations, share propaganda, and recruit collaborators, alongside onion sites (frequently rotated) used to distribute attack tools.

Disruption Activity 

The group conducts high-volume DDoS attacks supported by shared botnet infrastructure, often accompanied by website defacements carrying political propaganda. In June 2026, it announced a Strategic Cyber Alliance with DieNet to strengthen future operations. Earlier claim-stage attacks targeting Amazon (10 June) and the Netherlands (3 June) remain unverified, with no confirmed victims or technical IOCs publicly available.

Threat Actor: GORZ ROSTAM

Overview

GORZ ROSTAM is a politically motivated, anti-Israeli hacktivist group that emerged prominently through its Operation Seven Khans campaign, leveraging underground forums and dark web channels. Tied to pro-Iranian hacktivist narratives, it is characterized by large-scale data leaks, account takeover campaigns, and disruptive attacks against state and corporate infrastructure. 

Tools Used

The group primarily conducts Distributed Denial-of-Service (DDoS) attacks and website defacement campaigns, validating claimed disruptions through Check-Host and publishing defacement evidence via Zone-H and Defacer[.]id mirrors. Its Telegram channel also advertises a Tor-based "Data Forum" for distributing alleged leaked databases and privileged access. While the group claims credential leaks and data exposure, there is no publicly verified evidence identifying the specific malware, infostealer families, or DDoS framework used in its operations.

Targeted Sectors

(OBSERVED DATA 2024 TO 2026)

Government, banking, and e-commerce sectors in Israel are the main focus, aiming to compromise authentication systems and financial grids, alongside digital service providers in the UK such as Heleket[.]com.

Targeted Countries

(OBSERVED DATA 2024 TO 2026)

Israel is the primary target, where large datasets of compromised accounts were leaked, alongside the United Kingdom, where a DDoS attack was claimed reflecting both geopolitical motives and opportunistic disruption of Western-aligned assets.

Telegram Channels & Communication

 The group uses its official Telegram channel (hxxps[://]t[.]me/GORZROSTAM313/254), to publish attack announcements, propaganda, and promote alleged data leaks. In July 2026, it announced a Tor-based "Data Forum" advertising purported leaked databases, exploits, and privileged access to targeted organizations, positioning the platform as a distribution point for claimed stolen data. However, while the group claims to possess and distribute sensitive data,

Disruption Activity & Alerts

GORZ ROSTAM continues to conduct politically motivated disruptive cyber operations, primarily through claimed DDoS attacks against government, financial, and commercial organizations, occasionally accompanied by website defacement using allegedly compromised credentials. Recent campaigns include claims targeting Israel Discount Bank under "Operation Haft Khan," Bahrain's banking sector, and the UAE banking sector under "Operation Seven Stages." The group uses its Telegram channel to announce these operations and amplify their psychological impact; however, several attack claims remain independently unverified. Given its continued focus on Gulf and Israeli financial institutions, organizations in the regional banking sector should maintain heightened monitoring for potential service disruption and related cyber activity

Threat Actor: NXBB.SEC

Overview

NXBB.SEC is a publicly active threat actor first observed on 27 July 2025, primarily associated with DDoS attacks against government and public-facing organizations. Operating within the broader Cambodia-related cyber ecosystem, it publicly claims attacks through multiple Telegram channels, prioritizing recognition over intrusion capability.

Tools Used

The group employs the NXBBSEC DDoS Tool v1.0, allowing operators to specify targets and configure attack durations. No evidence indicates malware, ransomware, credential theft, or persistence mechanisms, suggesting reliance on commodity DDoS infrastructure.

Targeted Sectors

(OBSERVED DATA 2024 TO 2026)

Government ministries, public administration bodies, provincial authorities, and military organizations dominate targeting, with additional activity in education, IT, banking, healthcare, telecommunications, media, and other commercial industries. 

Targeted Countries

(OBSERVED DATA 2025 TO 2026)

Thailand is the primary focus, with targets including government ministries, military organizations, educational institutions, and public-sector services. Cambodia is a secondary area of activity, with limited targeting also observed in Vietnam, Singapore, and a small number of international entities.

Telegram Channels & Communication

The group's public channel (t[.]me/nxbb_sec), ~232 subscribers uses the slogan "#We_Are_NXBBSEC" to share attack announcements, defacement claims, and coordination activity, emphasizing public attribution and visibility.

Disruption Activity & Alerts

The group conducts coordinated DDoS campaigns against publicly accessible websites through a structured cycle of target selection, attack execution, public validation via Telegram, and rapid transition to subsequent targets, with no publicly observed persistence, lateral movement, or data exfiltration. Activity observed between July 2025 and May 2026 includes repeated campaigns targeting organizations in Thailand, Paññāsāstra University of Cambodia (PUC), Thailand's Ministry of Higher Education, Science, Research and Innovation, and a claimed attack against the Google website, indicating sustained disruptive operations into 2026.

Threat Actor: ZxS3C

Overview

ZxS3C is a recently emerged threat actor first observed in June 2026, with activity rapidly escalating through mid-to-late June 2026. Operating openly through Telegram, it publicly claims cyberattacks and shares proof of impact through downtime validation and defacement content, conducting coordinated DDoS and defacement campaigns against multiple organizations within short timeframes.

Tools Used

ZxS3C primarily uses DDoS techniques via a tool labeled "NXBBSEC" with an interface called "ATTACK SCOT (v1.0)," enabling repeated attacks with predefined durations. It also uses check-host.net to validate and showcase outages, indicating reliance on commodity or rented infrastructure.

Targeted Sectors

(OBSERVED DATA 2026 ) 

Government administration — ministries, provincial portals, and public service platforms in Thailand — is the most frequently impacted sector, alongside education, healthcare, legal services, media, and IT service providers.

Targeted Countries

(OBSERVED DATA 2026)

Thailand is the primary focus, with multiple government, healthcare, and educational institutions targeted in rapid succession. Secondary targeting includes Estonia, along with references to Israel, South Africa, the United States, and Venezuela, plus Cambodia-related imagery suggesting regional or ideological narratives.

Telegram Channels & Communication

The group's primary channel (t[.]me/ZxS3xx) announces attacks, lists targets, and shares proof of downtime and defacement activity, functioning as both a coordination platform and a propaganda outlet with direct, repetitive messaging.

Disruption Activity

Coordinated DDoS and defacement campaigns targeted Thai government entities including the Ministry of Justice, Department of Mineral Resources, Royal Tribute Portal, and Chiang Mai Province plus healthcare, education, media, and an Estonian hosting provider between June 15–22, 2026, causing widespread 502/500/429 errors and timeouts. Defacements displayed messages such as "Hacked by ZxS3C" alongside branding like "AnaJAK-NX" and "Dark Star NX."

Tools & Techniques 

While each actor's specific tooling is detailed in its individual profile, three broad capability tiers emerge across the ten profiled groups.

Commodity DDoS Infrastructure

Dark Storm Team, BD Anonymous, RipperSec, Yemen Cyber Group, 404 Cyber Crew, Elite Squad, NXBB.SEC, and ZxS3C primarily rely on commodity DDoS infrastructure, publicly available load-testing frameworks, and botnet-backed services to disrupt public-facing websites. Named tools include RipperSec's ANVIL v1.0 Cybersecurity Load Testing Framework and MegaMedusa DDoS, alongside the NXBBSEC DDoS Tool (ATTACK SCOT v1.0) used by NXBB.SEC and ZxS3C, suggesting shared tooling or operational lineage. Check-Host/check-host.net is commonly used to validate claimed service disruptions before attacks are publicly announced. 

Credential Theft & Data Leaks

GORZ ROSTAM distinguishes itself through credential leak operations and alleged stolen-data distribution alongside DDoS attacks. The group promotes leaked databases and compromised account data through its Telegram channel and Tor-based "Data Forum." While public reporting associates the group with credential theft and data exposure activities, no specific infostealer malware family has been publicly confirmed.

Destructive & Extortion Capability

UNiT313 represents the most advanced actor in this dataset, combining DDoS operations with destructive capabilities and extortion-related communications through Session. Unlike the predominantly disruption-focused groups, UNiT313 demonstrates the potential to progress beyond service disruption toward destructive cyber operations.

Communication Infrastructure

Telegram remains the primary communication platform across all profiled actors for announcing attacks, coordinating campaigns, publishing evidence, and amplifying ideological messaging. Several groups further supplement Telegram with dark web forums, onion sites, or data-sharing platforms, making continuous Telegram monitoring one of the most valuable OSINT sources for identifying emerging campaigns, target announcements, and attack claims across the hacktivist ecosystem.

Recommendations