# Indian Cyber Force

Indian Cyber Force (ICF) is an amateur hacktivist group from India which gained attention for conducting cyberattacks at targets which it perceives to be against Indian interests. The group appears to be active since the year 2022. Methods of cyberattacks employed by the group include DDoS attacks, Website defacements, Data breaches.
"Webz.io" named Indian Cyber Force among its list of 5 most active hacktivist groups of 2024. According to the website "Zone-Xsec", which archives global web defacement incidents, the group has been associated with more than 100 recorded instances of website defacement as of 2025.
ICF makes use of Telegram and X (formerly Twitter) to post announcements related to its activities. They have claimed their original Telegram account being banned by the platform. The group's social media handles feature the tagline "Your control is Temporary, Our reach is Infinite".

## Mentions

In October 2023, the Computer Emergency Response Team of Europe (CERT-EU) published its "Cyber Security Brief (October 2023)" which includes references to the ICF:
   "Indian Cyber Force (ICF) allegedly disrupted access to Palestinian entities, including a Hamas website, a telecommunication company, a bank, a government e-mail service, a transportation entity, and an ecommerce website, with the prominent groups Indian Cyber Force."
A member of cybersecurity team at Equinix, Will Thomas, said to the Wired (magazine):
   "The Indian cyber force actually claimed to DDoS hamas.ps and webmail.gov.ps"
On 23 October 2024, Le Monde, a French daily newspaper, published an article titled "The new era of hacktivism" which contains a mention to ICF:
   "NoName057, Anonymous Sudan, Philippines Exodus Security, Indian Cyber Force: It has become hard to make sense of the jungle of names that have proliferated, particularly on the messaging platform Telegram. It is difficult, too, to assess their real impact."

## Attacks
### 2023

* On September 9, CloudSEK, an India-based threat intelligence platform, disclosed that hacktivist groups from Pakistan and Indonesia were planning cyberattacks targeting India during the country's hosting of the G20 Summit. Indian hacktivist groups, including the ICF, announced plans for cyberattacks in retaliation. ICF reportedly compromised 100 websites and identified over 15 vulnerabilities in government websites. The group gained attention for targeting the domain of Indonesia's Kopassus military unit ("kopassus.mil.id"), making it inaccessible. Additionally, ICF took down the Indonesian Embassy's website, which remained offline for around 35 minutes.
* In September, Canadian Prime Minister Justin Trudeau alleged the Indian government to be involved in the killing of the Khalistani leader Hardeep Singh Nijjar, which lead to a diplomatic row between India and Canada. Following this incident, the Indian Cyber Force took down the Canadian military website with DDoS attacks which remained unavailable for two hours. Other websites targeted with DDoS attacks include that of the House of Commons, Elections Canada. Multiple websites belonging to restaurants and medical clinics in Canada were defaced. The defaced websites displayed a message on a dark background with a Matrix digital rain while a music kept playing.
* In October, following the October 7 Hamas-led attack on Israel, Indian Cyber Force launched attacks against Palestinian entities including Palestinian National Bank ("tnb.ps"), Palestinian Telecommunication Company ("paltel.ps"), Hamas ("hamas.ps") and "webmail.gov.ps". Reportedly they also gained unauthorized access into more than 200 networking devices belonging to schools, hospitals and other institutions in Palestine.
* In November, ICF launched a series of cyberattacks against Qatar, motivated by the country's decision to sentence eight former Indian Navy officers to death in an espionage case. Reportedly, they had accessed and exposed account details associated with Qatar, gained unauthorized access into multiple IP cameras and web servers, took down Qatar's eCommerce Portal by DDoS attacks for a duration of 2 hours as well as the website of Al Anees, a shopping store in Qatar. Additionally they defaced the website of a shopping store "oasis.qa"
* In November, ICF compromised and gained unauthorized access into Pakistan Police's CCTV Camera network, revealed compromised IP addresses and login information on their social media channels. The CCTV footage viewed through that IP address showed five people in uniform, working on computers.

### 2024

* In January, amid the India–Maldives diplomatic row, ICF targeted several Maldivian institutions with cyberattacks. Ministry of Homeland Security and Technology's official website was defaced with a dark background and a message conveying Maldives’ alleged “ungratefulness” despite help from India in the past.
* In June, ICF claimed to have hacked more than 150 IP cameras belonging to entities including National Bank of Pakistan, Zeen (clothing store in Pakistan) and other private organizations. They released video footages of the breached cameras on their social media handles.