Cardinal — Hacktivist Profile
Cardinal is a pro-Russian hacktivist group that has aligned with Iranian-backed cyber operations targeting Israel, claiming to have infiltrated Israeli Defense Forces network infrastructure during the 2023-2025 Gaza conflict period. The group operates via Telegram, publishing unverified claims of network access and data exfiltration from Israeli military systems. Cardinal represents the cross-ideological convergence of Russian nationalist hacktivism with pro-Palestinian operational objectives. Their claimed capabilities exceed what has been independently verified, and their operations are assessed as primarily influence-oriented with opportunistic disruption.Also tracked as
Cardinal Team, Monarch
Vendor research
- Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17) Palo Alto Networks Unit 42
- Newly Established Russian Hacker Alliance Threatens Denmark Truesec
- Russian Hacktivist Group "Russian Legion" Initiate OpDenmark Truesec
- Evaluating the Hacktivist Threat to Critical Infrastructure Dataminr
- 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict The Hacker News