Cyber Toufan
Cyber Toufan is an Iran-attributed ransomware group with an ideological motive, tracked by Brandefense. It targets 9 sectors, including Government and Technology, in 4 countries, including the United States and Canada.
- Toufan Al-Aqsa
- Toufan
- Origin
- Iran
- Techniques
- 0
- Exploited CVEs
- No CVE data
- Last seen
- Apr 6, 2026
- Record updated
Who They Target.
Arsenal · Malware And Tools.
- Toufanmalware
Indicators Of Compromise.
TLP:CLEAR1 indicator on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Cyber Toufan.
Cyber Toufan is a threat actor group that has gained prominence for its cyberattacks targeting Israeli organizations. The group's tactics suggest potential nation-state backing, possibly from Iran.
They have been involved in hack-and-leak operations, data breaches, and data destruction, impacting over 100 organizations. Cyber Toufan's activities align with geopolitical tensions in the Middle East and their attacks are characterized by a combination of technical breaches and psychological warfare.
Last updated Nov 10, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.