313 Team
313 Team is a threat actor group, tracked by Brandefense. It targets the Government and Finance sectors in Saudi Arabia. It uses 1 MITRE ATT&CK technique.
- Techniques
- 1
- Exploited CVEs
- No CVE data
- First seen
- Nov 1, 2024
- Last seen
- Apr 1, 2026
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
1 techniques across 1 of 14 tacticsReconnaissance·
Resource Development·
Initial Access·
Execution·
Persistence·
Privilege Escalation·
Defense Evasion1
Network Denial of Service
Credential Access·
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
About 313 Team.
313 Team is an Iraq-based threat actor that has conducted coordinated DDoS campaigns targeting multiple government servers in the UAE, Kuwait, and Romania, often in response to political statements. They have claimed responsibility for significant disruptions, including a one-hour shutdown of Romania’s National Tax Agency and an 18-hour outage of Kuwait's national e-government portal.
The group has also engaged in website defacements, showcasing coordinated branding with other aligned groups. Their operations reflect a focus on government infrastructure, employing DDoS techniques and leveraging public political discourse as justification for their attacks.
Last updated Nov 8, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.