Holy League between cyber alliances and pro-Palestinian mobilization

The strength of a coalition and the weight of its name

I would assess Holy League’s significance by examining how different actors might converge on shared targets and messages, since a coalition can gain influence even when its ability to present a united front exceeds what is known about cooperation among its members. That gap matters to intelligence analysis because a collective name may encourage observers to connect incidents that still require separate verification.

Radware’s December 16, 2024 report traces Holy League’s emergence to the previous July through the union of High Society and 7 October Union, describing a pro-Russian and pro-Palestinian cyber coalition whose declared membership requires verification. [1] Following its actual relationships therefore means establishing who cooperates and on what activities, rather than assuming that claimed membership gives each participant the capabilities, conduct, or connections attributed to others.

The Italian development that changes the assessment

The Italian reporting brings that distinction into focus. On October 25, Corriere della Sera reported an investigative hypothesis involving coordination between Movimento 17 Ottobre and cyber activity attributed to NoName057(16), in connection with protests planned for October 24. [2] Although Quotidiano Nazionale subsequently described messages of support posted by NoName and Dark Storm on October 23 concerning Italian and French protests, those messages need to be assessed for what they document without being treated, on their own, as confirmation of that relationship. [3]

The October 26 reporting changes the assessment, as Il Giorno and Repubblica stated that the detention order and the prosecutors’ application for judicial validation and continued custody contained no evidence of alleged contacts between Youssef Siher and NoName. Il Giorno also cited judicial sources saying that no evidence of the relationship had emerged at that point. [4] [5] Because the press reported this absence in connection with specific documents and a particular stage of the investigation, an operational relationship cannot be presented as established, while any findings from subsequent inquiries would need to be assessed on their merits.

The chronology of verification must therefore remain as visible as the chronology of events. Repetition across several outlets does not change the status of an investigative hypothesis, even when it becomes familiar to the public, whereas developments in the evidentiary record change how the story can responsibly be used in analysis.

The reciprocal relationship that public solidarity does not establish

A group may support a protest unilaterally to gain visibility, appropriate its significance, or incorporate it into its own narrative, which makes an association between a message and a demonstration insufficient to establish a reciprocal relationship. Coordination would become a stronger hypothesis if authenticated exchanges, agreements on timing and targets, or transfers of resources attributable to the actors involved emerged, although even temporal coincidence would need to be assessed against independent initiatives and alternative explanations.

The same discipline applies to state connections. The indictments announced by the U.S. Department of Justice on December 9, 2025 describe NoName as a Russian state-sanctioned project administered partly through CISM and link CyberArmyofRussia_Reborn to the GRU. [6] These prosecution allegations concern specific actors and, although relevant to threat assessment, do not establish Russian control over the entire Holy League coalition or a relationship with every civil society organization supporting Palestine. Nor does the similarity between the names 7 October Union and Movimento 17 Ottobre constitute an organizational connection.

Observed harm and the harm suggested by an attack claim

ENISA Threat Landscape 2026 provides a useful reference in its analysis of activity linked to NoName057(16) and the DDoSia project between July and November 2025, finding that 23.8 percent of the claims assessed were validated through independent service-availability checks. Because that result concerns a particular sample and method, it neither measures the Italian events of October 2026 nor establishes that every other claim was false. [7]

Operational assessment therefore needs to trace the relationship between the announced target, the service actually affected, and the activities depending on it, since a screenshot of an unreachable portal cannot establish the cause, duration, or scope of an interruption. Backlogs or difficulties for users may persist after a service returns quickly, whereas an outage confined to a public-facing page does not justify describing the attacker as controlling the entire infrastructure. Crediting an unproven capability would distort both the resources deployed and the information communicated.

The decisions that remain possible while evidence is examined

While attribution remains unresolved, an exposed institution can strengthen service protection and prepare alternative channels, setting priorities according to each service’s function, its use during the protest, and the time required to activate mitigation providers. Records with consistent timestamps and traceable provenance need to be preserved so that threats, anomalies, and public statements can subsequently be compared, without the response destroying evidence needed to clarify events.

I regard the separation between operational protection and public attribution as a condition for effective intelligence because it allows action while responsibility is examined, with the assessment of coordination remaining open to change if verified reciprocal contacts and a documented correspondence between agreements and actions emerge. Until then, institutional communication that distinguishes what happened to services from what remains under examination protects the credibility of any responsibility ultimately established while preserving the institution’s ability to defend itself.