{
	"id": "39c8d24a-b0e4-4f92-87f5-1950ec2d2da6",
	"created_at": "2026-04-06T00:18:16.411717Z",
	"updated_at": "2026-04-10T13:12:55.853195Z",
	"deleted_at": null,
	"sha1_hash": "19bc7ee65787581b8e014ef993fe2112802a5442",
	"title": "Cyber fighters of Izz Ad-Din Al Qassam, Fraternal Jackal",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 35247,
	"plain_text": "Cyber fighters of Izz Ad-Din Al Qassam, Fraternal Jackal\r\nArchived: 2026-04-05 19:15:03 UTC\r\nDescription(MEMRI) On September 18, 2012, the Qassam Cyber Fighters (QCF) posted its first message, in both\r\nEnglish and Arabic, on its Pastebin page; the message warned the world that it was now targeting U.S. banks for\r\nhacking attacks, and would do so in the future as well.\r\nSince its emergence, the group has vowed to continue to carry out cyber attacks against Western targets until\r\nYouTube removes the anti-Muslim video 'Innocence of Muslims,' stating in its first communiqué: 'All the Muslim\r\nyouths who are active in the Cyber world will attack to American and Zionist bases as much as needed such that\r\nthey say that they are sorry about that insult.'\r\nSince the September 18, 2012 message, in which it announced that it was planning to attack the Bank of America\r\nand New York Stock Exchange on that date, it has been widely speculated that the group's origins are in fact\r\nIranian. Western media sources, as well as analysts who have studied the QCF, have stated that it is actually an\r\nIranian front. Cyber security analyst Dancho Danchev performed the most authoritative open-source intelligence\r\n(OSINT) analysis on the issue of the group's links to Iran, aimed at exposing one of the individuals in the group,\r\nwhile former Senator Joseph I. Lieberman told C-Span that he believed that Iran's government was sponsoring the\r\ngroup's attacks on U.S. banks in retaliation for Western economic sanctions. Additionally, The New York Times\r\nquoted unnamed U.S. intelligence officials stating that the 'group is a convenient cover for Iran.'\r\nThe QCF claims to have attacked Bank of America, the New York Stock Exchange, Capital One Financial Corp,\r\nSunTrust Banks Inc., BB\u0026T, HSBC, JPMorgan Chase \u0026 CO, PNC Financial Services, U.S. Bancorp, Citigroup\r\nCitibank, Wells Fargo \u0026 Company, Ally Financial, Fifth Third Bancorp, Zions Bancorporation, Union Bank,\r\nComerica, Citizens Bank, Umpqua Bank, People's United Bank, University Federal Credit Union, Patelco Credit\r\nUnion, American Express, KeyCorp, Ameriprise Financial, Citizens Financial, BBVA Compass, UMB Financial\r\nCorporation, M\u0026T Bank, Bank of the West, Regions Financial Corp, Euronext, and Synovus Financial\r\nCorporation.\r\nRecorded Future found a possible overlap with Desert Falcons.\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=f64252d6-0e52-4fd9-8151-06bf35dcd905\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=f64252d6-0e52-4fd9-8151-06bf35dcd905\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=f64252d6-0e52-4fd9-8151-06bf35dcd905"
	],
	"report_names": [
		"showcard.cgi?u=f64252d6-0e52-4fd9-8151-06bf35dcd905"
	],
	"threat_actors": [
		{
			"id": "9ff60d4d-153b-4ed5-a2f7-18a21d2fa05d",
			"created_at": "2022-10-25T16:07:23.539852Z",
			"updated_at": "2026-04-10T02:00:04.647734Z",
			"deleted_at": null,
			"main_name": "Desert Falcons",
			"aliases": [
				"APT-C-23",
				"ATK 66",
				"Arid Viper",
				"Niobium",
				"Operation Arid Viper",
				"Operation Bearded Barbie",
				"Operation Rebound",
				"Pinstripe Lightning",
				"Renegade Jackal",
				"TAG-63",
				"TAG-CT1",
				"Two-tailed Scorpion"
			],
			"source_name": "ETDA:Desert Falcons",
			"tools": [
				"AridSpy",
				"Barb(ie) Downloader",
				"BarbWire",
				"Desert Scorpion",
				"FrozenCell",
				"GlanceLove",
				"GnatSpy",
				"KasperAgent",
				"Micropsia",
				"PyMICROPSIA",
				"SpyC23",
				"Viper RAT",
				"ViperRAT",
				"VolatileVenom",
				"WinkChat",
				"android.micropsia"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "bb08058c-a744-4129-aa80-10aa34ed8766",
			"created_at": "2022-10-25T16:07:24.474826Z",
			"updated_at": "2026-04-10T02:00:05.003307Z",
			"deleted_at": null,
			"main_name": "Cyber fighters of Izz Ad-Din Al Qassam",
			"aliases": [
				"Cyber fighters of Izz Ad-Din Al Qassam",
				"Fraternal Jackal",
				"QCF",
				"Qassam Cyber Fighters"
			],
			"source_name": "ETDA:Cyber fighters of Izz Ad-Din Al Qassam",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "d63af7da-1b27-4f7e-a006-e7398c38f436",
			"created_at": "2023-01-06T13:46:38.702633Z",
			"updated_at": "2026-04-10T02:00:03.073096Z",
			"deleted_at": null,
			"main_name": "Cyber fighters of Izz Ad-Din Al Qassam",
			"aliases": [
				"Fraternal Jackal"
			],
			"source_name": "MISPGALAXY:Cyber fighters of Izz Ad-Din Al Qassam",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434696,
	"ts_updated_at": 1775826775,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/19bc7ee65787581b8e014ef993fe2112802a5442.pdf",
		"text": "https://archive.orkl.eu/19bc7ee65787581b8e014ef993fe2112802a5442.txt",
		"img": "https://archive.orkl.eu/19bc7ee65787581b8e014ef993fe2112802a5442.jpg"
	}
}