Cyber Threat Actor: Shiite Hackers

Shiite Hackers is an alias used by a threat actor group that has been identified as operating from Iraq. The group first appeared in public reporting in April 2022 when it claimed responsibility for a distributed denial‑of‑service attack against an Israeli website. No other aliases or operational bases have been publicly disclosed for this actor. Observations to date are limited to this single incident, which remains the basis for any known profile. On 2022‑04‑20 the attackers launched a volumetric DDoS flood that targeted the website alongside several other Israeli online platforms. They stated that the action was taken in retaliation for the killing of Qasem Soleimani. The attackers described the target as symbolic of Israeli media, even though the site had no direct involvement in the military operation that led to Soleimani’s death. The resulting disruption was characterized as temporary, with the hosting provider restoring service after a brief outage. At the time of the initial reports the attack was still ongoing, indicating sustained traffic pressure.

The incident was noted as part of a broader pattern of politically motivated cyber activity directed at Israeli digital assets. No evidence has been presented to suggest that the group sought financial gain, data exfiltration, or espionage through this operation. The actors’ messaging linked the attack to a geopolitical grievance rather than to any criminal enterprise. This distinguishes the activity from typical financially motivated cybercrime campaigns.

The only tactic publicly associated with Shiite Hackers in this case is the use of a DDoS flood, with no mention of malware families, exploit kits, or custom tooling. Reporting did not detail any initial access vectors, credential harvesting, or post‑exploitation behavior. Consequently, no specific tools or techniques beyond volumetric traffic generation have been attributed to the group.

Attribution to a state sponsor or to a criminal consortium has not been established in open sources, leaving the group’s affiliations unclear. The reporting also referenced a previous unsuccessful hacking attempt by Turkish actors during an earlier Israeli military conflict, but that activity is separate from the Shiite Hackers incident. No further campaigns or operations have been publicly linked to Shiite Hackers beyond the April 2022 DDoS event.