Pro-Iran Hacktivists Use Telegram-Coordinated DDoS and Hack-and-Leak Attacks

Pro-Iran hacktivist networks are turning Telegram channels into hubs for cyber retaliation. Their campaigns combine website-disrupting DDoS floods with hack-and-leak claims, using public posts to recruit supporters, circulate target lists, and magnify disruption.

The activity has created a fast-moving digital front alongside regional tensions.

Unlike a conventional malware outbreak, this campaign model relies on coordination, visibility, and pressure. A channel can announce a target, direct followers toward an attack tool, publicize an alleged breach, and keep the story alive through reposts.

That mix can interrupt services while forcing victims to check claims, manage public messaging, and protect customers.

Analysts at DomainTools Investigations said in a report shared with Cyber Security News (CSN) that the ecosystem operates through Telegram channels and websites, shared target lists, DDoS-for-hire tools, recycled breach data, and leak-amplification campaigns.

The result is not always deep access to a victim network. Often, the objective is simpler: take a public service offline, portray an intrusion as a strategic success, and use leaked or recycled material to drive attention.

Yet the cumulative effect can be serious, especially when government, infrastructure, finance, and media organizations are repeatedly named.

Telegram-Coordinated DDoS and Hack-and-Leak Attacks

Telegram gives these networks a low-cost command space. Administrators can frame an operation, distribute instructions, post screenshots, and redirect followers within minutes.

Separate groups may also echo the same message, making a campaign look broader and more coordinated than its technical depth alone would suggest.

The DDoS component is built for availability damage. Large volumes of traffic can overwhelm a website or an exposed service, even when attackers have not entered the underlying network.

For the operators, the outage is only part of the goal: Telegram posts, branded graphics, and claimed results turn disruption into propaganda that can spread well beyond the original target.

Hack-and-leak activity adds uncertainty and reputational pressure. Threat actors may publish data, samples, credentials, or screenshots, but a public claim is not proof that a breach occurred or that the material is new.

Teams should therefore assess the evidence quickly, avoid amplifying unverified posts, and notify affected parties when validation shows genuine exposure.

The DomainTools investigation report describes a decentralized wartime cyber front rather than a single uniform actor. That structure lets participants use familiar tactics while tying them to a shared political narrative.

It also complicates attribution, because overlapping messages, recycled content, and temporary online identities can conceal who performed an attack and who merely promoted it.

For defenders, the operational challenge is not limited to keeping a homepage online. A sudden campaign can draw attention to dormant weaknesses, encourage copycat activity, and create an opening for phishing or credential attacks against stressed staff.

The most effective response joins technical resilience with clear communications and disciplined verification of every claimed compromise.

Defending Against Fast-Moving Campaigns

Organizations should review public-facing systems, remove services that do not need internet access, and make sure DDoS protection is ready before an incident.

They should also monitor for unusual traffic, preserve logs, and test the process for escalating an outage. Regular exposure reviews help security teams identify where a visible campaign could cause the most harm.

Access controls matter just as much. Multi-factor authentication, strong password practices, prompt patching, and network separation reduce the chance that a noisy campaign can be paired with a more damaging intrusion.

Organizations that run essential services should also rehearse how technical, legal, and communications teams will handle a leak claim before it becomes a public crisis.

Monitoring must include the information environment as well as network telemetry. Tracking Telegram narratives, impersonation, target lists, and leak announcements can give responders early warning, but it should never replace evidence-based incident work.

A well-prepared team distinguishes between an attention-seeking claim and confirmed compromise, then acts proportionately and documents the decision.

These campaigns thrive on speed, visibility, and uncertainty. Treating each post as a lead rather than a confirmed breach, while maintaining resilient public services, can limit operational disruption and the propaganda value attackers seek.

Help your security team focus on the that matter most. Use ANY.RUN Threat Intelligence Feeds to automate enrichment and improve detection accuracy.