Al-Qaeda's Cyber Jihad Movement Formally Joins Iran's Wartime Hacktivist Ecosystem in First Sunni-Shia Cyber Collaboration

The Global Network on Extremism and Technology documented a historic shift in jihadist cyber operations: al-Qaeda's Cyber Jihad Movement (CJM) declared on March 4 its 'entrance into the Iranian-American war,' explicitly joining pro-Iranian hacker movements. This is the first documented cross-ideological collaboration between Sunni jihadist and Shia-aligned hackers. CJM, which emerged in 2025 and formally pledged allegiance to al-Qaeda in August, is embedding within Iran's structured 'Electronic Operations Room' that coordinates hacktivist operations. Named groups operating in this ecosystem include Keymous+, DieNet, Handala Hack, Cyber Fattah, Fatimiyoun Cyber Team, and the Islamic Cyber Resistance in Iraq 313 Team. The convergence creates 'attribution pollution': Sunni and Shia actors now share infrastructure, malware, and command-and-control servers, severely complicating traditional actor attribution for IC analysts.