APT GroupSOCRadar source-of-truth import; pending cross-source consensus confidence

Cyber Squad 313

Cyber Squad 313 is a self-described Pakistani hacktivist group that aligns with pro-Palestinian and pro-Kashmir causes, publicizing its claimed denial-of-service-style website takedowns and defacements against targets associated with Israel and Israel-aligned interests through Telegram and X/Twitter. The group asserts it does not operate for profit, presenting its activity as demonstrations against perceived oppression in Palestine and Kashmir. Its operations include formal statements and warnings with explicit demands like content removal and public apologies, and it engages in religiously framed warnings. Black Cyber, Cyber Alpha, and Legend ALI are referenced in its announcements as possible team members.

Directory Briefing

Top 10 Talking Points

Cyber Squad 313 should be treated as an intrusion cluster, not a single immutable toolkit.¹

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

The public record does not establish one dependable initial-access path.¹

Begin with identity, email, remote access, edge appliances, and exposed applications rather than narrowing the investigation to the first malware alert.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity scope should remain open until authentication evidence is reviewed.¹

Absence of a named credential technique is not evidence that accounts are clean; validate privileged use, new sessions, MFA changes, and service-account activity.

The investigation should distinguish transient execution from durable access.¹

Review accounts, scheduled execution, remote-management tooling, cloud configuration, and externally reachable infrastructure for residual access.

Behavioral telemetry is more durable than a malware hash.¹

Prioritize unusual process ancestry, remote execution, account use, network paths, and administrative changes because tooling can change faster than the actor's operational requirements.

Preserve independent telemetry before containment changes the scene.¹

Endpoint, identity, network, cloud, email, and backup logs provide the cross-check needed when the actor's public record does not clearly describe defense evasion.

The actor's objective should be inferred from evidence, not the label.¹

Determine whether the intrusion was positioned for espionage, theft, disruption, access resale, or a later-stage operation before briefing impact.

Victimology is broad enough that sector alone is weak negative evidence.¹

Retained targeting includes Manufacturing, Wholesale Trade, Retail, Transportation&Warehousing, and Information Services across United Arab Emirates, Austria, United Kingdom, and Israel; translate those sectors into the organization's exposed systems and high-value data.

The first briefing should separate containment confidence from attribution confidence.¹

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Bottom Line Up Front

BLUF

Cyber Squad 313 should be treated as an intrusion cluster, not a single immutable toolkit.¹

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

The public record does not establish one dependable initial-access path.¹

Begin with identity, email, remote access, edge appliances, and exposed applications rather than narrowing the investigation to the first malware alert.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity scope should remain open until authentication evidence is reviewed.¹

Absence of a named credential technique is not evidence that accounts are clean; validate privileged use, new sessions, MFA changes, and service-account activity.

The investigation should distinguish transient execution from durable access.¹

Review accounts, scheduled execution, remote-management tooling, cloud configuration, and externally reachable infrastructure for residual access.

Behavioral telemetry is more durable than a malware hash.¹

Prioritize unusual process ancestry, remote execution, account use, network paths, and administrative changes because tooling can change faster than the actor's operational requirements.

Preserve independent telemetry before containment changes the scene.¹

Endpoint, identity, network, cloud, email, and backup logs provide the cross-check needed when the actor's public record does not clearly describe defense evasion.

The actor's objective should be inferred from evidence, not the label.¹

Determine whether the intrusion was positioned for espionage, theft, disruption, access resale, or a later-stage operation before briefing impact.

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.¹

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type¹

APT Group profile

First Seen¹

Not available

Last Seen¹

Not available

Origin¹

Motivation¹

APT Group activity retained from SOCRadar

Primary Access Pattern¹

Not available

Objective¹

APT Group activity retained from SOCRadar

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases¹

AnonXBlack_PK

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure¹

United Arab EmiratesAustriaUnited KingdomIsraelIndiaJordanNetherlandsUnited States

Target Sectors¹

ManufacturingWholesale TradeRetailTransportation&WarehousingInformation ServicesFinanceRental & LeasingProfessional&Technical ServicesEducational ServicesHealthCare & Social AssistanceArts & EntertainmentPublic AdministrationElectrical&Electronical ManufacturingAir TransportationInsuranceAdministrative & Support ServicesSporting and Athletic Goods ManufacturingHuman Rights OrganizationsNational Security

Associated Activity¹

Observed Activity: Claimed DDoS-style website takedowns causing target outages.Observed Activity: Claimed website defacements.Publicity & Communication: Third-party website-availability monitoring reports posted as proof of claimed takedowns.Publicity & Communication: Operation of a Telegram channel and an X/Twitter presence under the name Cyber Squad 313.Publicity & Communication: Recurring operational hashtags: #OpIsrael, #OpUAE, #FreePalestine (#freepalastine), #CyberSquad313, #Humanity, #Justice, #freedom.Publicity & Communication: Standardized post formatting for Israeli targets, including a fixed anti-Israel tagline.Identity: Pakistani self-identification and national branding.Publicity & Communication: Formal statements and warnings with explicit demands (content removal, public apology).Publicity & Communication: Religiously framed warning directed at the producers and corporate sponsors of a streaming television series over allegedly blasphemous content.Targeting Pattern: Claimed targeting pattern: Israeli government, judicial, scientific, democratic, medical, and policy institutions; Indian government bodies and universities; Dutch police and sporting associations; UAE aviation; US civic and health organizations.Group Structure: Possible team-member identities referenced in channel announcements: Black Cyber, Cyber Alpha, and Legend ALI.

ATT&CK IDs¹

Not available

Campaign Context

Associated Campaigns / Operations

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

Indicators

IOCs And Observable Retention

SOCRadar reported 0¹IntelliOS retained 0

No public IOC values are currently retained in IntelliOS for this profile. Future enrichment can add cited observables from SOCRadar, Microsoft threat intelligence, Google/Mandiant, CrowdStrike, MITRE CTI, CISA, vendor reports, and other reliable open sources.

Source coverage: 1 source group tracked; 0 currently contribute retained observable or context rows.

Retained Public Observables¹

Source	Reported	Retained	Coverage Status
SOCRadar¹	0	0	Profile retained; no SOCRadar IOC count currently stored.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Cyber Squad 313	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Cyber Squad 313	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Cyber Squad 313.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor	Threat actor directory source for profile fields and reported activity.

Loading Threat Actor Cards

Cyber Squad 313

Top 10 Talking Points

Cyber Squad 313 should be treated as an intrusion cluster, not a single immutable toolkit.1

The public record does not establish one dependable initial-access path.1

The first detected host should not define the compromise boundary.1

Identity scope should remain open until authentication evidence is reviewed.1

The investigation should distinguish transient execution from durable access.1

Behavioral telemetry is more durable than a malware hash.1

Preserve independent telemetry before containment changes the scene.1

The actor's objective should be inferred from evidence, not the label.1

Victimology is broad enough that sector alone is weak negative evidence.1

The first briefing should separate containment confidence from attribution confidence.1

BLUF

Cyber Squad 313 should be treated as an intrusion cluster, not a single immutable toolkit.1

The public record does not establish one dependable initial-access path.1

The first detected host should not define the compromise boundary.1

Identity scope should remain open until authentication evidence is reviewed.1

The investigation should distinguish transient execution from durable access.1

Behavioral telemetry is more durable than a malware hash.1

Preserve independent telemetry before containment changes the scene.1

The actor's objective should be inferred from evidence, not the label.1

Victimology is broad enough that sector alone is weak negative evidence.1

The first briefing should separate containment confidence from attribution confidence.1

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Cyber Squad 313 should be treated as an intrusion cluster, not a single immutable toolkit.¹

The public record does not establish one dependable initial-access path.¹

The first detected host should not define the compromise boundary.¹

Identity scope should remain open until authentication evidence is reviewed.¹

The investigation should distinguish transient execution from durable access.¹

Behavioral telemetry is more durable than a malware hash.¹

Preserve independent telemetry before containment changes the scene.¹

The actor's objective should be inferred from evidence, not the label.¹

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.¹

Cyber Squad 313 should be treated as an intrusion cluster, not a single immutable toolkit.¹

The public record does not establish one dependable initial-access path.¹

The first detected host should not define the compromise boundary.¹

Identity scope should remain open until authentication evidence is reviewed.¹

The investigation should distinguish transient execution from durable access.¹

Behavioral telemetry is more durable than a malware hash.¹

Preserve independent telemetry before containment changes the scene.¹

The actor's objective should be inferred from evidence, not the label.¹

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.¹