Q&A Interview
Threat Intelligence
Inside 313 Team:
An Exclusive Interview
We spoke directly with the Islamic cyber resistance group that has targeted Microsoft 365, government infrastructure, and Western platforms in their own words.
313 Team is an Islamic cyber resistance group that has been active since 2023, operating in alignment with Iran’s Axis of Resistance. The group has conducted DDoS attacks, data breaches, and infrastructure disruptions targeting Western and Israeli interests including a claimed 5+ hour DDoS attack on Microsoft 365.
Throughout 2025 and into 2026, 313 Team has collaborated with other hacktivist groups to conduct operations across the Middle East and beyond. The group describes itself as an independent Islamic cyber resistance with no affiliation to any official entity, though its ideology aligns with Iran’s Wilayat al-Faqih framework.
Their targets have included government infrastructure in Israel, Kuwait, and the United States; educational platforms like Clever and Moodle; Microsoft services; and various Western-aligned organizations reflecting an operational scope that extends well beyond regional borders.
The group claims to be developing advanced cyber weapons including RATs, ransomware, and stealers, and has warned that “the largest cyber war in the Middle East” is approaching.
Daily Dark Web reached out to 313 Team directly. What follows is their unfiltered response published in full, without editorial alteration. The views expressed are entirely those of the group and do not reflect the positions of Daily Dark Web.
⚠ EDITORIAL NOTE: The statements below are published for informational and journalistic purposes. Daily Dark Web does not endorse, promote, or support the activities, ideology, or targets of 313 Team or any threat actor group.
How do you define your group’s mission and objectives?
We are an Islamic cyber resistance; our goal is to achieve justice, and our mission is to resist the Zionist-American occupier and protect those whose rights have been taken away.
What factors influence your target selection?
The main factor in selecting our targets depends on geopolitical events. We resist anyone who attacks us, and in light of our recent operations, we are in support of the Islamic Republic of Iran in its war against the Zionist-American occupation.
How do you respond to concerns that cyber operations may impact civilians or unintended parties?
We follow the principle of “an eye for an eye.” Just as the Iranian school in Minab was targeted, resulting in the deaths of dozens of innocent children, in response we targeted the American educational platform Clever and the Moodle platform, disrupting them for one hour. The aim is to disturb their daily life and shift the battle beyond regional borders.
How do you distinguish your group from other actors operating in the same region?
We distinguish ourselves by having, since our founding in 2023, extensive expertise and working across all fields. We have members specialized in DDoS attacks, highly experienced hackers, and very skilled programmers. Here is exclusive information: we are currently developing advanced software such as RATs, ransomware, and stealers, which we will announce soon. These projects are in their final stages. All of this expertise operates with very high coordination and precision.
How do you view the role of cyber operations in broader geopolitical conflicts?
Cyber warfare in cyberspace is no less important than ballistic missile warfare. Data leaks, server breaches, or shutting down a major company’s website can achieve what ballistic missiles cannot. Remember this statement from us: “Soon, the largest cyber war in the Middle East will erupt.”
What message are you aiming to communicate through your recent activities?
We will crush the enemies and continue resisting until our last breath. There is no place for them in cyberspace. The enemies must understand that resistance is an idea, and ideas cannot die. We will resist and avenge the blood shed in Palestine, Iran, Lebanon, Iraq, and Yemen.
How do you address skepticism regarding claims made by cyber groups?
We issued warnings on our Telegram channel to two teams (we refrain from mentioning their names) after announcing that the attack on the Kuwaiti government would continue until further notice and that Kuwaiti government websites would remain offline. Hours after our announcement, two teams claimed responsibility for the attacks we believe their claim is only for publicity. This does not harm us, but it is frustrating to see.
What do you believe is the biggest misunderstanding about your group?
The biggest misunderstanding surrounding our group is that we are linked to the Iranian Revolutionary Guard or the Iraqi Popular Mobilization Forces. In reality, we have no connection to them.
How do you see your activities evolving in the near future?
We will attract more resources for our operations, whether human or technical. We will introduce advanced software into our cyber arsenal, increase the power of our DDoS attacks, and target more sensitive services, systems, and websites.
Is there anything you would like to add?
We will not retreat and will continue on this path. Interpol and the FBI do not intimidate us. What Israel and the United States fail to understand is that we possess a firm ideology that we fight for, and this is the secret of our strength.
Following the initial interview, we received several questions from our audience and community. We relayed them to 313 Team. Below are their responses.
When you first became involved in these activities, how did you justify your actions to yourself? Has that perspective changed over time?
First, we do not justify anything. Second, we lead these cyber operations based on a firm ideology and continue our right to resist until complete victory. Everyone resists using the means available to them, and we have chosen cyber resistance.
How would you describe what you do today is it closer to a profession, a form of competition, or something you see as necessary?
What we are doing today is a form of resistance, but in cyberspace. We are leading a fierce cyber war against enemy systems, and yes, we see this as necessary based on our ideology and beliefs.
What factors influence your decision-making when selecting targets?
The factors influencing our choice of targets are geopolitical events. Therefore, we select targets based on global geopolitical developments in general, and in the Middle East in particular. The target bank is continuously updated.
Do you see yourself as acting independently, or as part of a broader system or movement?
We are an Islamic cyber resistance operating independently, with no affiliation to any official or unofficial entity.
What would you say to organizations or companies that monitor and analyze your activities?
We see many reports about our attacks, but in reality they overlook how our attacks are carried out and the methods we use to shut down or breach websites and servers. Behind every successful attack is a deep study of the targets and their vulnerabilities. For example, when we targeted Microsoft 365 with a DDoS attack lasting more than 5 hours, it was highly successful. During the attack, we exploited a CVE via a network-based DDoS attack, disrupting the service and making it unavailable for an extended period. Therefore, behind every breach or large-scale DDoS attack, there is precise targeting and in-depth analysis. They should also study the methods we use to shut down or breach websites and servers.
Why don’t you pick government targets that will hurt? Why Reddit and Internet Archive?
We have a target bank that is updated daily. The targets include government websites, government-related services, and other services that affect people’s daily lives. Our goal is to completely destroy the enemies’ infrastructure.
Throughout 2025, 313 Team collaborated with other groups. With the rise in hacktivist groups operating as attribution fronts for state-sponsored activity, how do you view this when partnering? What assurance can you provide that your motivations are real and that you are not a government puppet?
That is correct. We have close relationships with some strong cyber teams, and they are actually our friends. We rely on them to launch joint attacks, and this is something we consider excellent. We are the Islamic cyber resistance, and our motivations are genuine in defending the Islamic nation. We may share our motivations and goals with Iran or with countries in the Axis of Resistance due to shared ideology, but this does not mean that we work with them.
What ideology do you follow? What methods do you use? Will your attacks evolve in the future?
We follow an Islamic-Shiite ideology aligned with the Iranian concept of Wilayat al-Faqih. We use various methods. For DDoS attacks to become large and successful, we can mention one method: scanning servers for CVEs that allow us to consume server resources, thereby disabling them for long periods. We actually used this in our attacks on Microsoft 365, which led to major disruptions in most Microsoft services. As for our intrusion methods, we use tools and vulnerabilities such as Zero-Day exploits, CVEs, and several other techniques to compromise servers and websites. This is certain: our attacks in the future will develop significantly. We will target supply chains using advanced software that we will introduce into operation soon.
313 Team presents itself as one of the more technically ambitious hacktivist groups to emerge from the Middle Eastern threat landscape. Their answers reveal an organization that is ideologically motivated, operationally diverse, and actively expanding its capabilities from DDoS attacks into ransomware, RATs, and supply chain targeting.
What stands out is the explicit acknowledgment of their ideological framework Wilayat al-Faqih combined with emphatic denials of state affiliation. The group claims independence while openly sharing strategic alignment with Iran and the Axis of Resistance. Whether this distinction holds under scrutiny remains an open question for the intelligence community.
313 Team claims to be in the final stages of developing RATs, ransomware, and stealer malware. They have warned that “the largest cyber war in the Middle East will erupt” and stated intentions to target supply chains using advanced software. These claims, if operationalized, would represent a significant escalation from DDoS and web defacement operations.
The group’s claimed Microsoft 365 disruption, CVE exploitation methods, and stated intentions to deploy offensive malware suggest a trajectory that moves beyond hacktivism into more sophisticated cyber operations. Organizations with exposure to Middle Eastern geopolitics should monitor this group closely.
Daily Dark Web will continue monitoring 313 Team activity and reporting on developments as they emerge.
Daily Dark WebRead More
R1
T1
