DarkStormTeam APT hacktivist Targeting Egyption Websites
Today we will be knowing more about one of the most aggressive DDOS-ers in the Recent Feeds and appearing to be Anti-zionism and Pro palestine threat actor and today I REACHED THIER TELEGRAM HANDLE!
WHO , WHY AND WHEN
Dark strom Team is a pro palestine threat actor which started in scene in 2023 and their motive was Motivation: Financial, geopolitical, mainly pro-Palestinian — unconfirmed links with Russia highly likely — strong partnerships with other group their number one source of money comes from DDOS-as-as-service (e:Platforms such as Channel DDoS v2, ZeusAPI Services, Krypton Networks and InfraShutdown are used.) they got Really famous on March 2025 by claiming that they took responsibility for cyberattack on X and Other US Airports.
The motive to attack this Organization more than the other is 100% Political from their believes as they would attack Egypt for claiming their full support to Israel during Gazza strip war.
Our convo
i Joined his channel to see more about services and pricing and we chatted more about How we would deploy this Attack against a Shopify domain Website in Egypt and here is snippets from our chat (he never ever try to do more info sharing rather we Go into his Secure channel (session ID was given to start negotiating ) to talk more about DBots tools used
Cooperation and Alliances
Akatsuki Cyber Team and Dark Storm Team, there have been online claims and joint-branded announcements on Telegram and other social platforms indicating cooperation on some campaigns. However, there is no independent, authoritative public evidence confirming a formal, long-term alliance between the two groups.
Get Ziad Saad’s stories in your inbox
Join Medium for free to get updates from this writer.
Akatsuki Cyber Team is a politically motivated hacktivist collective known for participating in coordinated cyber campaigns targeting government agencies, critical infrastructure, and private organizations. The group primarily claims Distributed Denial-of-Service (DDoS) attacks, website defacements, and alleged data breaches, often publicizing its operations through Telegram
Egyptian SYSTEMS FALL AGAINST BOTNET DDOS ATTACKS
in the 28th of July Cairo Airport website recieved a massive amount of connections in small Period of time which is suspected to be DOS attack and Users started reporting to “https://onlineornot.com › website-down-checker” and “https://www.isitdownrightnow.com” and the answer was
In the same day many Websites had been down due to this DDOS camoaign and they announced it in the 29th of july in the telegram group , the victims was Cairo.gov/Alexandria.gov/aswan.gov/portsaid.gov/southsainai.gov and these were static websites for news and annoucments only but there where Also Minstries had been down for a long time and e services stopped a good amount of Time
One of the most striking moments of the campaign was the threat actor’s public claim of an attack against the official Presidency of Egypt website. Whether or not the full extent of the claimed impact can be independently verified, selecting the Presidency as a target reflects a deliberate attempt to strike one of the country’s highest-profile government assets. Attacks against such high-value public-facing systems are intended to generate maximum psychological, political, and media impact, extending the operation’s influence well beyond any immediate technical effects. This serves as a reminder that the public-facing attack surface of critical government institutions remains a prime target for hacktivist groups seeking both disruption and global visibility.
TTPs and MITRE Attack Mapping
The following section analyzes the threat actor’s observed TTPs and maps them to the MITRE ATT&CK framework to provide a structured understanding of the techniques used throughout the campaign and how to defend while using SAFE security controls.
Conclusion
Dark Storm Team demonstrates how hacktivist groups continue to leverage DDoS attacks, public propaganda, and geopolitical events to maximize disruption and visibility. While not every public claim can be independently verified, the repeated targeting of Egyptian government services highlights the importance of strengthening public-facing infrastructure, continuous threat intelligence, and DDoS mitigation capabilities. Understanding the group’s TTPs and mapping them to the MITRE ATT&CK framework enables defenders to better prepare for and respond to similar campaigns in the future.
Follow for more and more Investigations Things is going to Be REAL ;)
