Iran -- Cyber Threat Actors¶

1. Strategic Context¶

From Stuxnet to Offensive Capability¶

Iran's offensive cyber program is, in many ways, a direct product of the Stuxnet operation (discovered 2010). The joint U.S.-Israeli campaign to sabotage Iran's Natanz uranium enrichment facility demonstrated that cyber weapons could cause physical destruction -- and that Iran was acutely vulnerable. Within two years, Tehran had invested heavily in both defensive and offensive cyber capabilities, launching Operation Ababil (DDoS against U.S. banks) in 2012 and the destructive Shamoon attack against Saudi Aramco the same year (Mandiant; CISA).

By 2025, Iran operates one of the most active nation-state cyber programs globally, behind China and Russia but ahead of North Korea in breadth of targeting. The program has evolved from crude DDoS and defacement to sophisticated espionage, wiper deployment, ransomware-as-cover, and coordinated influence operations.

IRGC vs. MOIS: Two Pillars of Iranian Cyber Operations¶

Iran's cyber operations are split across two principal organizations, each with distinct mandates and operational styles:

Cyber as Asymmetric Strategy¶

Iran's cyber program fills a critical gap in its strategic calculus. Facing overwhelming conventional military disadvantage against the U.S. and Israel, crippling economic sanctions, and limited power-projection capability, cyber operations provide:

• Low-cost retaliation: Destructive attacks on adversary infrastructure without crossing kinetic thresholds
• Sanctions circumvention intelligence: Espionage against financial, trade, and diplomatic targets
• Regional influence: Information operations targeting Gulf states, Israel, and Arab populations
• Domestic control: Surveillance of dissidents, journalists, and human rights activists both inside Iran and in the diaspora

Geopolitical Escalation Triggers¶

Iranian cyber operations correlate strongly with geopolitical events:

timeline
    title Iranian Cyber Escalation Timeline
    section 2012-2014
        Stuxnet fallout : Operation Ababil (DDoS on US banks)
                        : Shamoon destroys 35,000 Saudi Aramco workstations
                        : Bowman Avenue Dam intrusion
                        : Sands Casino hack (retaliation for Sheldon Adelson comments)
    section 2015-2018
        JCPOA era : Relative de-escalation during nuclear deal period
                  : Activity resumes after US withdrawal (May 2018)
    section 2019-2020
        Soleimani killing (Jan 2020) : ZeroCleare wiper targeting Middle East energy
                                     : Spike in defacement and retaliatory attacks
                                     : Travelex ransomware attack
    section 2021-2022
        Regional tensions : Moses Staff / Abraham's Ax "lock and leak"
                          : Iran-Albania cyber confrontation
                          : Emennet Pasargad indictments
    section 2023-2025
        Israel-Hamas conflict : CyberAv3ngers target US water systems (Unitronics PLCs)
                              : BiBi wiper deployments across Israel
                              : Cyber Toufan mass data leaks
                              : Cotton Sandstorm influence operations
                              : Sustained Mint Sandstorm credential campaigns

2. Known Groups & Attribution¶

The table below catalogs the principal Iranian threat groups, their aliases across vendor naming conventions, assessed organizational affiliation, and primary activity type.

3. How They Operate¶

Operational Philosophy¶

Iranian threat actors are generally less technically sophisticated than Chinese or Russian counterparts but compensate with persistence, aggression, and a willingness to cause visible destruction. Key characteristics:

• Opportunistic exploitation over zero-days: Iranian groups overwhelmingly exploit known (N-day) vulnerabilities rather than developing or purchasing zero-day exploits. They move fast once a CVE is published, particularly for internet-facing devices (Mandiant).
• Heavy reliance on VPN/firewall exploits: Fortinet, Pulse Secure, Citrix, and F5 vulnerabilities are consistently favored initial access vectors.
• Password spraying at industrial scale: APT33/Peach Sandstorm in particular conducts massive credential-spraying campaigns against thousands of organizations simultaneously (Microsoft).
• Elaborate social engineering: APT42 and Mint Sandstorm build fake personas (journalists, academics, think-tank researchers) over weeks or months to lure high-value targets into credential phishing (Google TAG).
• Wipers as a first-resort weapon: Unlike most nation-states that reserve destructive capability, Iranian actors deploy wipers frequently as retaliation or coercion.
• "Lock and leak" operations: Encryption of victim data (mimicking ransomware) combined with public data leaks on Telegram channels -- designed for psychological and reputational damage rather than financial gain.
• Influence operations integration: Cyber intrusions are increasingly paired with information operations -- stolen data is selectively leaked, social media accounts amplify narratives, and hack-and-leak personas are created to maximize impact.

4. TTPs (Exhaustive)¶

Mapped to the MITRE ATT&CK framework across the kill chain.

Initial Access¶

Execution¶

Persistence¶

Defense Evasion¶

Lateral Movement¶

Collection¶

Impact¶

Command & Control¶

5. Tooling Arsenal¶

6. Notable Campaigns & Operations¶

7. Primary Targets¶

By Geography¶

By Sector¶

8. Defensive Implications¶

Patch Management for Edge Devices¶

Iranian groups' heavy reliance on exploiting internet-facing VPN appliances, firewalls, and Exchange servers makes patch management for edge devices the single highest-impact defensive measure.

• Prioritize patching for Fortinet, Pulse Secure/Ivanti, Citrix, F5, and Microsoft Exchange vulnerabilities
• Maintain an accurate inventory of all internet-facing assets
• Subscribe to CISA Known Exploited Vulnerabilities (KEV) catalog alerts
• Implement virtual patching via WAF/IPS where immediate patching is not possible

Password Spray Detection¶

• Enforce MFA on all externally accessible services (Azure AD/Entra ID, VPN, Exchange Online, OWA)
• Implement smart lockout and IP-based throttling
• Monitor for distributed low-and-slow spray patterns (APT33 uses residential proxies to distribute attempts)
• Deploy Azure AD/Entra ID Identity Protection or equivalent

Email Security Against Credential Phishing¶

• Deploy advanced anti-phishing with URL rewriting and time-of-click analysis
• Implement FIDO2/hardware security keys for high-value targets (executives, researchers, policy staff)
• Train staff to recognize impersonation of journalists, academics, and think-tank contacts
• Monitor for newly registered lookalike domains

OT/ICS Security¶

• Water sector (CyberAv3ngers): Change default credentials on all PLCs/HMIs; remove Unitronics and other PLCs from internet exposure; segment OT networks; monitor for unauthorized access to TCP port 20256 (Unitronics default)
• Energy sector: Implement network monitoring at Purdue Model Level 3.5; deploy OT-specific threat detection
• Follow CISA ICS advisories for Iranian-specific TTPs

Wiper Resilience and Recovery¶

• Maintain offline, immutable backups tested for restoration
• Implement network segmentation to limit wiper propagation
• Deploy EDR with behavioral detection for MBR modification, mass file overwrite, and partition table corruption
• Develop and test incident response playbooks specifically for destructive attacks
• Pre-position recovery infrastructure (gold images, clean media)

Social Media Awareness¶

• Brief staff in targeted roles (journalists, academics, Middle East policy researchers) on Iranian social engineering TTPs
• Verify journalist and academic contacts through independent channels before sharing information or clicking links
• Monitor for impersonation of organizational staff on LinkedIn, Twitter/X, and WhatsApp

9. Market Impact¶

Iranian cyber operations drive demand across several cybersecurity market segments:

10. Recent Activity (2024--2026)¶

Confirmed and Assessed Activity¶

CyberAv3ngers -- Continued OT Targeting (2024--2025) Following the November 2023 Unitronics campaign, CyberAv3ngers expanded targeting to additional water and wastewater systems. U.S. Treasury imposed sanctions on six IRGC-CEC officials in February 2024. The group developed custom malware for IoT and OT devices, including a modified CentOS-based toolkit (Claroty Team82). Continued probing of internet-exposed industrial control systems through 2025.

BiBi Wiper Campaigns (2023--2024) BiBi-Linux and BiBi-Windows wipers were deployed against Israeli organizations across multiple sectors in the months following October 7, 2023. The wipers were designed for maximum destruction -- corrupting file systems, overwriting data, and damaging partition tables. Deployment continued into mid-2024 as part of broader Iran-aligned cyber operations against Israel.

Mint Sandstorm / Charming Kitten Credential Campaigns (2024--2025) Microsoft and Google TAG reported sustained campaigns targeting Middle East policy researchers, university faculty, journalists, and current/former government officials. APT42 subgroups used increasingly sophisticated phishing lures, including fake conference invitations, interview requests, and document-sharing pretexts. Expanded targeting to individuals involved in Israel-Iran diplomacy and regional security discussions.

Cotton Sandstorm Influence Operations (2024--2025) Emennet Pasargad-linked operators conducted influence operations targeting U.S. audiences during the 2024 election cycle, building on 2020 election interference tactics. Operations included fake activist websites, social media personas, and amplification of divisive narratives. Microsoft and FBI issued joint advisories on Iranian influence operations targeting U.S. elections.

Peach Sandstorm Defense Sector Targeting (2024--2025) APT33 continued large-scale password spray campaigns against defense, satellite, and pharmaceutical organizations globally. Compromised Azure infrastructure was used for C2 relay via the EagleRelay tool. Microsoft assessed increased sophistication in post-compromise tradecraft, including use of legitimate remote management tools for persistence.

Sustained Israel-Focused Operations (2024--2026) The broader Israel-Hamas conflict and subsequent regional escalation maintained an elevated tempo of Iranian-aligned cyber operations against Israeli targets. Multiple groups -- including Cyber Toufan, Agrius, and Moses Staff successors -- continued data theft, wiper deployment, and hack-and-leak operations. The operational tempo is assessed as remaining high into 2026 given unresolved regional tensions.

Assessed Trends for 2025--2026¶

• OT/ICS targeting expansion: Beyond water systems to energy, transportation, and manufacturing -- particularly in Israel and Gulf states
• AI-assisted operations: Adoption of large language models for phishing content generation, persona management, and target research (assessed based on general nation-state trends)
• Increased collaboration between groups: More joint operations combining espionage access (MOIS groups) with destructive capability (IRGC groups), as seen in the ZeroCleare precedent
• Continued "lock and leak" evolution: Increasingly professional data-leak operations with Telegram channels as primary distribution
• Cloud targeting maturation: Greater focus on cloud environments (Azure, M365, Google Workspace) as organizations migrate infrastructure

11. Sources & Further Reading¶

Government Advisories and Indictments¶

• CISA -- Iran Cyber Threat Overview -- Central repository of U.S. government advisories on Iranian threats
• CISA Advisory AA23-335A -- CyberAv3ngers Targeting Unitronics PLCs -- Specific guidance on water sector targeting
• DOJ -- Indictment of Emennet Pasargad Employees (2022) -- Election interference charges
• U.S. Treasury -- Sanctions on IRGC-CEC Officials (2024) -- CyberAv3ngers-related designations
• FBI Flash -- Iranian Ransomware Activity -- Najee Technology / Afkar System indictments

Vendor Threat Intelligence¶

• Mandiant -- APT Groups -- Comprehensive group profiles including Iranian actors
• Microsoft Threat Intelligence -- Iran Overview -- Sandstorm-family group tracking (Mint, Peach, Mango, Cotton, etc.)
• Google TAG -- APT42 Report -- Detailed APT42 tradecraft analysis
• CrowdStrike -- Kitten-Family Threat Actors -- Charming Kitten, Helix Kitten, Static Kitten, Refined Kitten profiles
• Check Point Research -- Iranian Threat Landscape -- Scarred Manticore and other group reporting
• IBM X-Force -- ZeroCleare -- Technical analysis of the ZeroCleare wiper
• Claroty Team82 -- CyberAv3ngers Research -- OT-specific Iranian threat analysis
• Security Joes -- BiBi-Linux Wiper -- Initial BiBi wiper discovery

MITRE ATT&CK¶

• MITRE ATT&CK -- APT33
• MITRE ATT&CK -- APT35
• MITRE ATT&CK -- MuddyWater
• MITRE ATT&CK -- OilRig

Academic and Think Tank¶

• Carnegie Endowment -- Iran's Cyber Threat -- Strategic analysis of Iran's cyber program in geopolitical context
• Council on Foreign Relations -- Cyber Operations Tracker -- Historical record of state-sponsored cyber incidents including Iranian operations

Glossary¶

This glossary defines the acronyms and key terms used throughout the cybersecurity market research site. Use it as a quick reference when navigating segment analyses, pain-point discussions, and opportunity assessments.

A¶

B¶

C¶

D¶

E¶

F/G¶

H¶

I¶

L¶

M¶

N¶

O¶

P¶

R¶

S¶

T¶

V¶

X¶

Z¶