When Extremists Go Technical: NVE–Pro-Iranian Hacktivist Convergence
How NVE actors are building ties with pro-Iranian hacktivist and Islamist extremist ecosystems on Telegram—creating new pathways between ideology, access, and capability.
This appears to be the first documented instance of nihilistic violent extremist (NVE) actors forming explicit relationships with pro-Iranian hacktivist and Islamist extremist networks on Telegram. What was once a separation between ideology and technical capability is eroding—creating a pathway where intent, tools, and access are beginning to align.
A Quiet Shift
On 22 March, the International Online Crime Coordination Center (IOC3) identified a development that should be treated as a step-change, not a trend: NVE ecosystems—often divided into three clusters, IRL Com (focused on real-world violence), Extortion Com, and Hacker Com—are evolving. The Hacker Com, long underexamined despite causing tangible harm, is now forming explicit alliances with pro-Iranian hacktivists and Hezbollah-linked ecosystems on Telegram.
This is not a routine cross-platform overlap. It represents a qualitatively different moment—a sustained and declared interaction between NVE actors (primarily Western, accelerationist, and nihilistic), pro-Iranian hacktivist networks, and Islamist extremist ecosystems.
Historically, these spheres operated separately, even when they shared adversaries. That separation is now eroding. Once interaction shifts from proximity to partnership, the question is no longer who is talking to whom—but what capabilities are now being transferred, shared, or enabled.
From Ideology to Capability
What makes this development significant is the direction of movement. According to IOC3, NVE actors are not merely present in these spaces—they are actively seeking technical tools, infrastructure, operational guidance, and access to more experienced operators. Telegram functions as a capability bridge, normalizing discussions around offensive techniques, enabling informal mentorship, and lowering friction in accessing tools. The implication is clear: the barrier between intent and execution is narrowing.
A Structural Break: The Emergence of a Hybrid Ecosystem
More than a behavioral shift, this represents a structural break.
Since the beginning of the war in Ukraine, there have been growing indications that state-aligned actors are not only interacting with but actively seeking to recruit extremist communities, particularly in relation to real-world (IRL) activity. These extremist actors were primarily far-right and not traditionally part of the Com ecosystem. What is emerging now, however, is not only a new alignment between the Com and Iranian-supported actors, but also a parallel shift on the technical side: elements of the Hacker Com are increasingly integrating into these ecosystems and seeking technical collaboration.
For years, there has been overlap at the individual level—such as hacktivists with extremist affiliations—but these ecosystems remained largely separate, with little structured collaboration between communities. That is now changing, as NVE Hacker Com actors embed within hacktivist and Islamist-linked environments, interact directly with more capable operators, and gain access to tools and infrastructure, resulting in a hybrid ecosystem where ideology and capability are no longer separate layers but part of the same networked environment.
IOC3 cyber analysts note:
“We have clearly seen NVE forming alliances with quite a few pro-Iranian hacktivist groups. Our investigation has uncovered NVE members extremely active in Hezbollah and other Iranian groups, specifically becoming involved in groups that provide instructional guides for making explosives. This is a clear indication of alliance and intelligence sharing.”
Additional indicators reinforce this trend, including direct outreach between administrators, cross-participation in shared Telegram channels, and engagement with instructional content. While this does not confirm coordinated attacks, it demonstrates growing alignment and knowledge exchange.
Why This Matters
Even without confirmed joint operations, this convergence matters. It represents an unprecedented cross-ecosystem linkage, introduces clear capability transfer risks, and accelerates pathways from intent to action while blurring traditional threat categories. While no coordinated attacks have been confirmed, focusing only on outcomes misses the signal: intent, capability, and access are aligning. The key question now is whether this translates into action—through collaboration, shared infrastructure, or a shift from discussion to execution.
This is not just another case of online extremism; it represents a convergence where previously distinct ecosystems are beginning to overlap in ways that could materially change the threat landscape. When ideology connects with capability, risk doesn’t just increase—it accelerates, and in this case, that process is already underway.
A final note: I write this blog on a volunteer basis, driven by genuine concern and a commitment to raising public awareness. If my work has been helpful or informative, please consider supporting it through a paid subscription or a donation via Stripe or PayPal.