Every escalation in the Middle East brings the same board question, "are we a target for Iran?", and answering it needs more than a list of group names. Iranian state cyber activity comes from two main sponsors, the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS), and it mixes espionage, destructive wipers, hack and leak campaigns run through fake hacktivist personas, attacks on internet-exposed industrial controllers and, increasingly, access sales to ransomware gangs. This guide maps the main clusters to their sponsors as governments, MITRE ATT&CK and research teams describe them, explains the patterns that repeat, and sets out the detections and controls that matter most during a period of heightened threat. It is for threat intelligence analysts, SOC and OT security leads, and security leaders briefing executives. For one group in depth, see the Charming Kitten (APT35) Threat Actor Profile.
Key takeaways
- Two sponsors with different habits. IRGC-linked groups lean towards espionage against people, OT defacement and influence; MOIS-linked groups run long intrusions that end in wipers and leaks under invented personas.
- Personas hide the state. Homeland Justice, Karma and Handala present as hacktivists or criminals, but ATT&CK and the US Justice Department link them to MOIS operations.
- Low sophistication still works. Default PLC passwords, unpatched SharePoint and Exchange servers, password spraying and MFA push fatigue account for many documented intrusions.
- Destruction often follows long access. In the 2022 Albania attack, initial access came about 14 months before the wiper; a hand-off between access and destruction teams is a recurring MOIS pattern.
- Management planes are the new wiper. The March 2026 Stryker incident, claimed by the MOIS-linked Handala persona, used a hijacked administrator account and Microsoft Intune remote wipe rather than custom malware.
Who runs Iranian cyber operations
Public attribution of Iranian groups is less precise than for Russia: governments rarely name units, and vendors split activity into many clusters. The table records only what the sources say, with their confidence wording. See the Threat Actor Naming Conventions Guide for how Microsoft's Sandstorm names, Mandiant's APT numbers and Check Point's Manticore names relate.
| Cluster (ATT&CK) | Common aliases | Sponsor, as attributed | Main activity |
|---|---|---|---|
| G0059 Magic Hound | Charming Kitten, APT35, Mint Sandstorm, TA453, Phosphorus | IRGC (ATT&CK: "likely on behalf of") | Long-running social engineering and espionage against officials, academics, journalists |
| G1044 APT42 | Overlaps CALANQUE, Mint Sandstorm, TA453 (Mandiant) | IRGC Intelligence Organization (Mandiant assessment) | Credential harvesting, Microsoft 365 data theft from NGOs, media, legal and academic targets |
| G1027 CyberAv3ngers (ICS) | Soldiers of Solomon | IRGC-affiliated (CISA AA23-335A); US Treasury sanctioned IRGC Cyber-Electronic Command officials over the Unitronics PLC hacks | Defacing internet-exposed Unitronics PLCs and HMIs, often false or inflated claims |
| G1059 NIMBUS MANTICORE | UNC1549, TA455 | IRGC (ATT&CK) | HR-themed social engineering, theft of IT documentation and intellectual property, pivoting through compromised organisations |
| G0069 MuddyWater | Mango Sandstorm, Static Kitten, Seedworm, TA450 | Subordinate element of MOIS (CISA AA22-055A, with FBI, CNMF and NCSC) | Espionage against telecoms, defence, local government, oil and gas; occasional ransomware |
| G0049 OilRig | APT34, Hazel Sandstorm, EUROPIUM, Helix Kitten | Iranian government (ATT&CK); Microsoft links EUROPIUM to MOIS with moderate confidence in the Albania investigation | Espionage in the Middle East and beyond, supply chain abuse of trusted relationships |
| G1055 VOID MANTICORE | Red Sandstorm, Banished Kitten, personas Homeland Justice, Karma, Handala Hack | MOIS (ATT&CK, Check Point; US DOJ for Handala) | Wipers combined with hack and leak against Albania, Israel and the US |
| G1030 Agrius | Pink Sandstorm, BlackShadow | Public reporting links to MOIS (ATT&CK) | Ransomware-styled wiper operations against Israeli targets |
| G0087 APT39 | Chafer, Remix Kitten | MOIS through a front company (ATT&CK) | Tracking individuals via travel, hospitality and telecoms data |
| G0117 Fox Kitten | Pioneer Kitten, Lemon Sandstorm, UNC757 | Government of Iran (CISA AA24-241A) | Edge device exploitation and access brokering to ransomware affiliates |
| G0064 APT33 | Peach Sandstorm, Elfin | Suspected Iranian (ATT&CK) | Aviation and energy targeting, large-scale password spraying |
Treat the sponsor column as a guide to intent, not a certainty. ATT&CK notes that APT42 and Magic Hound overlap but are tracked separately, and many vendors' clusters do not map one-to-one.
IRGC and MOIS: how their operations differ
| Dimension | IRGC-linked clusters | MOIS-linked clusters |
|---|---|---|
| Typical targets | Individuals (dissidents, journalists, policy experts, campaign staff), defence and aerospace, exposed OT | Governments, telecoms, critical infrastructure and companies in Israel, Albania, the Gulf and the US |
| Initial access | Weeks of rapport building, fake news outlets and NGO domains, fake login pages, MFA prompts; default PLC passwords | Exploiting public-facing servers (SharePoint CVE-2019-0604, Exchange CVE-2020-0688, Netlogon CVE-2020-1472), spearphishing with ZIP archives |
| Signature outcome | Mailbox and cloud data theft; defaced HMIs | Wipers, fake ransomware, leaks under personas |
| Identity abuse | Token capture, Keep Me Signed In sessions, app passwords, mailbox delegation | Misconfigured service accounts, Exchange ApplicationImpersonation, hijacked administrator accounts on management planes |
| Defender priority | Phishing-resistant MFA for high-risk people, including personal accounts; OT exposure | Patch and segment exposed servers, tier zero protection, offline backups, bulk-action approvals |
Recurring operational patterns
Hack and leak through personas
Microsoft's investigation of the July 2022 attack on the Albanian government found four Iranian actors in separate roles: DEV-0861 gained access and stole data, DEV-0166 stole data, DEV-0842 deployed ransomware and then a wiper, and DEV-0133 probed infrastructure. The Homeland Justice persona pushed messaging and leaks aimed at the MEK dissident group based in Albania. Check Point later described the same "Homeland Justice" persona, and the "Karma" persona against Israeli organisations, as Void Manticore, which received access handed over by a separate cluster, Scarred Manticore. ATT&CK now lists Handala Hack as Void Manticore's current primary persona. See the Handala and Void Manticore Threat Actor Profile.
Wipers dressed as ransomware
- Albania 2022: ransomware (GoXml.exe) followed by a wiper (cl.exe) using the legitimate EldoS RawDisk driver, with the same licence key as the ZeroCleare wiper, which IBM linked to Iranian actors in 2019 (per Microsoft).
- Israel and Albania 2023 to 2024: Check Point documents CI Wiper, partition wipers that delete the drive layout, and the BiBi wiper with Linux and Windows variants that also delete shadow copies; operators also wiped manually with SDelete and Format.
- Agrius and Moses Staff: ATT&CK records ransomware and wiper operations against Israeli targets, and Moses Staff's stated aim of damage without a ransom demand.
The defensive point: a "ransom note" from an Iran-linked actor does not mean a decryptor exists. Plan recovery as if for a wiper. See the Wiper Malware Guide.
Attacks on internet-exposed OT
CISA's AA23-335A describes IRGC-affiliated CyberAv3ngers compromising at least 75 Unitronics Vision Series PLCs and HMIs from 22 November 2023, at least 34 of them in the US water and wastewater sector, by logging in to internet-connected devices with default or no passwords on the default TCP port 20256. The June 2025 joint fact sheet from CISA, FBI, DC3 and NSA restated the lesson during the Israel and Iran conflict: disconnect exposed OT, remove default passwords, use phishing-resistant MFA for access into OT networks and monitor for firmware and configuration changes. See the CyberAv3ngers Threat Actor Profile and the NIST SP 800-82 OT Security Guide.
Access brokering to ransomware affiliates
The August 2024 advisory AA24-241A from CISA, FBI and DC3 describes Iran-based actors tracked as Pioneer Kitten, Lemon Sandstorm, Parisite and Rubidium gaining network access to US and foreign organisations in education, finance, healthcare, defence and local government, and working with ransomware affiliates, alongside espionage for the Iranian government. The June 2025 fact sheet warns of the same collaboration. For an organisation this means an Iranian intrusion may surface as an ordinary criminal ransomware event. See the Pioneer Kitten Threat Actor Profile and the Initial Access Brokers Guide.
Social engineering of high-value people
Mandiant's May 2024 APT42 report describes typosquatted news and NGO domains, weeks of trust-building correspondence impersonating real NGO staff, fake Google, Microsoft, Yahoo and DUO login pages that capture tokens, MFA push approvals, and persistence through Keep Me Signed In and app passwords. Data was exfiltrated to an attacker-controlled OneDrive account named after the victim's own organisation. Implants (NICECURL, TAMECAT) are used where needed, but much of the cloud activity relied only on valid credentials and built-in Microsoft 365 features.
Where identity fits
Most documented Iranian intrusions turn on an identity weakness rather than a novel exploit:
- Service accounts with admin rights: in Albania a misconfigured service account in the local administrators group gave the attackers durable access within two months. Inventory and de-privilege service accounts. See the Group Managed Service Accounts (gMSA) Guide.
- Mail impersonation rights: the same attackers abused the Exchange ApplicationImpersonation role through a fake "HealthMailbox" account. Review every holder of mailbox-wide rights.
- Device and OT defaults: default PLC passwords are machine credentials; treat them as secrets with owners and rotation.
- Privileged management planes: in the Stryker incident a compromised administrator account created a new Global Administrator and issued Intune wipes. Limit standing Global Administrator rights and require multi-administrator approval for bulk wipes and retires. See the Privileged Access Management Guide.
- Long-lived sessions and app passwords: disable legacy authentication and app passwords where unused, shorten session lifetimes for high-risk users, and use phishing-resistant MFA. See the Phishing-Resistant MFA Guide.
ATT&CK mapping of common techniques
| Technique (ATT&CK v20) | Where it appears | Primary control |
|---|---|---|
| T1190 Exploit Public-Facing Application | MOIS clusters (SharePoint, Exchange); Pioneer Kitten (edge devices) | KEV-driven patching; remove internet exposure of management interfaces |
| T0883 Internet Accessible Device; T0859 Valid Accounts (ICS) | CyberAv3ngers on Unitronics PLCs | Disconnect PLCs from the internet; unique passwords; VPN or gateway with MFA |
| T1110.003 Password Spraying; T1621 MFA Request Generation | APT33, APT42 | Phishing-resistant MFA; number matching at minimum; sign-in risk policies |
| T1566.002 Spearphishing Link; T1684.001 Impersonation; T1585.001 Social Media Accounts | APT42, Magic Hound, NIMBUS MANTICORE | High-risk user programme; verification of unexpected contacts through known channels |
| T1557 Adversary-in-the-Middle; T1528 Steal Application Access Token | APT42 cloned login pages | FIDO2 or certificate-based authentication; token protection |
| T1078 Valid Accounts; T1098.002 Additional Email Delegate Permissions | Albania attackers; APT42 mailbox access | Service account review; mailbox permission change alerts |
| T1505.003 Web Shell | Albania attackers | File integrity monitoring on web servers; EDR on SharePoint and Exchange hosts |
| T1567.002 Exfiltration to Cloud Storage | APT42 (attacker OneDrive) | Tenant restrictions; alerts on uploads to unmanaged cloud accounts |
| T1485 Data Destruction; T1561.002 Disk Structure Wipe; T1486 Data Encrypted for Impact | Void Manticore, Agrius, Albania attackers | Immutable offline backups; rehearsed rebuild; bulk-action approvals in device management |
| T1491.002 External Defacement; T1491.001 Internal Defacement | Hacktivist personas, CyberAv3ngers HMIs | Website and HMI integrity monitoring; prepared communications |
Detection and measurement
What to monitor
- Exposure: internet scans of your own ranges for PLC and HMI ports (including TCP 20256), VNC, RDP, SSH and web management interfaces, as the June 2025 fact sheet lists.
- Server exploitation: new web shells or unusual child processes of w3wp.exe on SharePoint and Exchange servers.
- Identity: password spray patterns, repeated MFA prompts for one user, new app passwords, Keep Me Signed In sessions from VPN or hosting providers, mailbox delegation and ApplicationImpersonation changes.
- Privileged role changes: any new Global Administrator or Intune Administrator assignment, and any bulk wipe, retire or delete action in device management.
- Destruction precursors: loading of raw disk drivers, shadow copy deletion, boot configuration changes and mass file renames.
- OT changes: PLC logic downloads, firmware updates and mode changes outside change windows.
Metrics
- Exposed OT devices: count of internet-reachable PLCs, HMIs and engineering workstations, target zero.
- KEV exposure age: days that internet-facing systems with KEV-listed flaws stay unpatched.
- High-risk users on phishing-resistant MFA: percentage of executives, policy, research and press staff covered, including personal accounts where the organisation supports it.
- Standing Global Administrators: number of permanent tier zero cloud admins; trend down with just-in-time elevation.
- Restore test success: time to rebuild a representative site from offline backups in the last exercise.
Heightened-threat plan during Middle East escalation
- Decide relevance (day 1): are you in Israel or the Gulf, in the US defence industrial base with Israeli ties (named in the June 2025 fact sheet), a water or energy operator, an NGO, media, academic or legal organisation working on Iran, or a supplier to any of these? Record the answer and owner.
- Close exposure (days 1 to 3): disconnect or allowlist internet-exposed OT, change default passwords, patch KEV-listed edge, mail and collaboration servers, and block remote management interfaces at the perimeter.
- Harden identity (days 2 to 7): require phishing-resistant MFA for administrators and high-risk users; review service accounts, app passwords and mailbox-wide rights; enable multi-administrator approval for device wipes. Test conditional access changes in report-only mode first and keep a break-glass account and documented rollback.
- Hunt (week 1): search 90 days or more of logs for the advisory behaviours above; treat IP indicators as short-lived.
- Prepare for destruction and leaks (weeks 1 to 2): verify offline backups and restore times, rehearse an identity and endpoint management rebuild, and prepare communications for a persona claiming a breach that may be exaggerated. See the DDoS Response Playbook for hacktivist DDoS.
- Stand down deliberately: keep hardening changes, record residual risks and lessons, and schedule a review before the next escalation.
Small versus large organisations
A small business outside the named sectors gains most from three things: no internet-exposed OT or management interfaces, patched edge and mail servers, and phishing-resistant MFA for administrators. A large or named organisation should also run a high-risk user programme, subscribe to national CERT and sector ISAC feeds, keep a persona and leak response plan with legal and communications teams, and test bulk-action approvals in its device management platforms.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| NIST CSF 2.0 | ID.RA-02, ID.RA-03, DE.AE-07 | Receive and use threat intelligence on Iranian clusters; record which threaten you |
| NIST CSF 2.0 | PR.AA-03, PR.PS-02, PR.DS-11 | Authenticate users, services and devices; maintain and replace software; tested backups |
| NIST SP 800-53 Rev. 5 | PM-16, RA-3(3), RA-10 | Threat awareness, dynamic threat awareness, threat hunting |
| NIST SP 800-53 Rev. 5 | IA-2(1), IA-5(1), AC-17, SC-7, CP-9 | Privileged MFA, password strength (default credentials), remote access, boundary protection, backups |
| ISO/IEC 27001:2022 Annex A | 5.7 Threat intelligence; 8.13 Information backup | Threat intelligence process; backup and restore |
| CIS Controls v8.1 | Controls 4, 6, 7, 11, 12 | Secure configuration (defaults), access control and MFA, vulnerability management, data recovery, network infrastructure |
| MITRE ATT&CK v20 | G0059, G1044, G1027, G1059, G0069, G0049, G1055, G1030, G0087, G0117, G0064 | Group pages for technique coverage reviews |
Common failure patterns
- Taking the persona at face value: treating a "hacktivist" claim as nuisance noise when the operator is a state service with destructive intent and long prior access.
- Restoring from a ransom note mindset: waiting for negotiation or a decryptor when the malware is a wiper; recovery should start at once from offline backups.
- Leaving controllers on the internet with defaults: the Unitronics campaign needed no exploit at all.
- Unprotected management planes: the Stryker Intune wiper attack shows one hijacked administrator account wiping tens of thousands of devices in hours when bulk actions need no second approval.
- Protecting only corporate accounts of targeted staff: APT42 and Charming Kitten pursue people across personal email and messaging as well.
- Short log retention: with access months before impact, 30 days of logs cannot show how the attacker got in.
Practitioner checklist
- Record whether your sector, geography, partners or staff fall within documented Iranian targeting, and name an owner for heightened-threat periods.
- Remove internet exposure of PLCs, HMIs and remote management interfaces; change every default device password.
- Patch KEV-listed SharePoint, Exchange, edge and collaboration flaws on short deadlines.
- Enforce phishing-resistant MFA for administrators and high-risk users; disable app passwords and legacy authentication where unused.
- Review service accounts, Exchange impersonation rights and mailbox delegation; alert on changes.
- Require multi-administrator approval for bulk wipe, retire and delete actions in endpoint management and alert on new Global Administrators.
- Keep immutable offline backups and rehearse a rebuild that assumes no decryptor.
- Retain identity, server and OT logs for at least 90 days and hunt on publication of each relevant advisory.
- Prepare legal and communications responses for persona leak claims and hacktivist DDoS.
Standards and references
- CISA and partners: AA23-335A IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors
- CISA and partners: AA22-055A Iranian Government-Sponsored Actors Conduct Cyber Operations (MuddyWater)
- CISA, FBI, DC3 and NSA: Iranian Cyber Actors May Target Vulnerable US Networks and Entities of Interest
- WaterISAC: CISA Advisory AA24-241A Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations
- MITRE ATT&CK: Groups (Magic Hound, APT42, CyberAv3ngers, MuddyWater, OilRig, VOID MANTICORE, Agrius, Fox Kitten)
- Microsoft: Microsoft Investigates Iranian Attacks Against the Albanian Government
- Check Point Research: Bad Karma, No Justice, Void Manticore Destructive Activities in Israel
- Google Cloud (Mandiant): Untangling Iran's APT42 Operations
Related NHI Mgmt Group resources: Charming Kitten (APT35) Threat Actor Profile · MuddyWater Threat Actor Profile · OilRig Threat Actor Profile Guide · Russia State Cyber Operations Guide · Cyber Warfare Guide