Altoufan Team, also known as Al-Toufan Team, Cyber Toufan, or Cyber Toufan Al-Aqsa, emerged in February 2022 as a politically motivated hacktivist group. It operates as a 'faketivist' persona for the Iranian-affiliated Cotton Sandstorm, an Iranian cyber actor linked to the Islamic Revolutionary Guard Corps (IRGC), creating plausible deniability for state-sponsored cyber operations. The group's primary motivation is not financial gain but rather political and psychological disruption, specifically driven by anti-Zionist and anti-monarchy sentiments, aiming to protest the normalization of relations between Middle Eastern countries and Israel and to incite political unrest. Notably, the group revived its persona in early 2026 after a period of dormancy to claim new targets, often amplifying its political narratives through coordinated cyber activity and information operations.