Update (October 27, 2026): This profile now covers Resecurity’s analysis of Nasir Security’s tactics, self-described names and overstated energy-sector claims. No new Nasir Security claims or official actions have been publicly reported in the last 90 days.
Aliases: No vendor tracking names. Resecurity reports that the group has described itself as “Sons of Hezbollah Lebanon,” “Sons of Al-Nusayr” and “Al-Nasir Resistance”
Type: Pro-Iranian hacktivist persona focused on hack-and-leak claims
Attribution: Suspected pro-Iranian. No government has attributed the group, and researchers have not ruled out false-flag activity
First observed: October 2025
Primary operations: Data theft and leak claims, spear phishing and business email compromise, exploitation of public-facing applications, theft from insecure cloud storage
Primary targets: Energy companies and their contractors, government agencies, customs and aviation in the Gulf region, and Israeli organizations
Status as of October 27, 2026: Quiet, with no new public claims reported since April 2026
Nasir Security is a pro-Iranian hacktivist group that emerged in October 2025 and published a rapid series of breach claims against energy companies, government agencies and aviation targets across the Middle East between March and April 2026. It posts alleged proof of access on its leak site alongside ideological statements framed as resistance.
Researchers at Resecurity found that much of the group’s data appears to have come from contractors and third parties rather than the core systems of the organizations it named, and that its claims about data volumes are often overstated.
Latest Nasir Security activity
This timeline covers the last 90 days of developments, including confirmed incidents, law enforcement actions and unverified extortion claims. Earlier events are listed in the coverage archive below.
No new Nasir Security claims, confirmed incidents or law enforcement actions have been publicly reported in the last 90 days. The group’s most recent claim covered by BreachNews was the alleged Yad Vashem breach on April 15, 2026.
Origins and evolution
Resecurity traces the group’s first public activity to around October 5, 2025, when it claimed a breach of Israeli IT company Taldor. The group then went largely quiet until March 2026, when it began publishing claims at a steady pace as regional tensions involving Iran escalated.
Based on its own posts, Nasir Security has claimed the following operations:
- October 2025: Taldor allegedly breached
- March 13, 2026: Dubai Petroleum allegedly breached
- March 15, 2026: Oman CC Energy Development allegedly breached
- March 17, 2026: Rumaila Operating Organisation allegedly compromised
- March 21, 2026: Al-Safi Oil Company allegedly breached
- March 26, 2026: UAE Federal Customs Authority access claimed
- March 30, 2026: Dubai Airport data leak claimed
- April 5, 2026: Kuwait Ministry of Interior allegedly breached
- April 15, 2026: Yad Vashem allegedly breached
The pacing of these posts suggests a coordinated disclosure strategy, possibly releasing access or data obtained earlier.
How Nasir Security operates
Resecurity’s analysis describes a group that relies on common, low-cost intrusion methods rather than advanced tooling:
- Spear phishing and business email compromise against employees and suppliers
- Exploitation of vulnerable public-facing applications
- Collection of data from misconfigured or insecure cloud storage
- Use of contractor and partner access to reach data about larger organizations
Unlike financially motivated groups such as ShinyHunters, Nasir Security has not been seen extorting victims or selling data. Its goal appears to be visibility, signaling and psychological pressure, which gives it reason to inflate the impact of its claims.
Notable incidents
BreachNews has reported on 3 of the group’s claims. In March 2026, it claimed a breach of Dubai Airport and threatened to release passport data. In April, it claimed a breach of Kuwait’s Ministry of Interior during active Iranian strikes, then claimed to have stolen records from Yad Vashem, including records of world leaders. None of these claims has been publicly confirmed by the named organizations.
Law enforcement actions
No arrests, indictments, sanctions or government advisories naming Nasir Security have been publicly reported as of October 27, 2026.
Relationship to broader Iran-aligned activity
Nasir Security operates within a wider ecosystem of pro-Iranian cyber personas that increased activity during 2026. Its targeting and messaging resemble those of Handala Hack, which U.S. authorities link to Iran’s Ministry of Intelligence and Security, and its claims coincided with coordinated DDoS campaigns by pro-Iranian groups. No public evidence ties Nasir Security directly to a state agency.
Defensive takeaways
- Review what data contractors and suppliers hold about your organization, and require them to meet the same security standards.
- Train staff to spot spear phishing and payment or invoice fraud, and verify unusual requests by phone.
- Audit cloud storage for public or overly broad access permissions.
- Patch internet-facing applications quickly and monitor them for exploitation.
- Prepare a response plan for leak claims, since many hacktivist claims overstate what was taken.
All Nasir Security coverage
The following archive contains BreachNews reporting related to Nasir Security, from the latest developments backward.
- Iranian hacktivists claim Yad Vashem breach, release records of world leaders
- Nasir Security claims breach of Kuwait Ministry of Interior amid active Iranian strikes
- Pro-Iranian Nasir Security claims Dubai Airport breach with passport data threat
Current threat assessment
As of October 27, 2026, Nasir Security appears inactive in public, with no new claims reported for about 6 months. Hacktivist personas often go quiet and return during periods of regional escalation, so the group or its operators could resurface under the same name or a new one.
Gulf energy companies, government agencies and their contractors remain the most likely targets if activity resumes.
Attribution and verification
Nasir Security’s claims are largely unverified, and confirmation from affected organizations has been rare. Resecurity found that claimed data volumes were overstated and that some data came from third parties. Its self-described links to Hezbollah and other groups have not been confirmed, and researchers have warned of possible false flags. Everything on this page is alleged unless an affected organization or authority has confirmed it.
Sources and advisories
Changelog
- October 27, 2026: Added Resecurity’s findings, a fact box, law enforcement status, defensive takeaways, sources and a 90-day activity note. Fixed heading capitalization.
- May 5, 2026: Profile published.
