Cyber Threat Actor: Sabareen
| Actor Type | Location | Known Incidents |
Activist
|
Palestine
|
1 incident |
|---|
Profile
Sabareen is a militant Palestinian group that operates under the alias Sabareen and is known to be based in Palestine. The group has publicly identified itself as a militant organization and has used the Telegram platform to claim responsibility for cyber activities. No additional aliases or structural details about the group’s size, leadership, or internal organization are available in the open sources referenced.
On July 4 2022, Sabareen claimed responsibility for a cyberattack against Mass Transit System Ltd, the company overseeing the construction of the Tel Aviv metro. The intrusion affected the victim’s operating systems and servers, disrupting operations during the metro’s development phase. The claim was disseminated via Telegram, and Iranian state media outlets reported the incident, noting that the coverage could be interpreted as serving anti‑Israel propaganda narratives. Subsequent analyses by other threat intelligence sources suggested a possible connection to an Iraqi hacker group that has been observed targeting Israeli intelligence infrastructure, although Sabareen itself has not been formally linked to that group in any official attribution.
Based solely on the reported incident, Sabareen’s observed activity involves targeting Israeli critical infrastructure, specifically a mass‑transit project, with an apparent aim of causing operational disruption. The group’s claimed use of Telegram for communication indicates a reliance on publicly accessible messaging platforms for propaganda and claim‑making. No specific malware families, initial‑access vectors, or tooling techniques have been disclosed in the public reporting, and no definitive state sponsorship, criminal consortium ties, or broader campaign history have been established beyond this single attributed operation. Consequently, the profile remains limited to the confirmed facts of the alias, geographic base, the claimed responsibility for the Tel Aviv metro‑related attack, and the manner in which the claim was communicated.