Skip to content
Threat actors by attributed origin

Iran-Attributed Threat Actors.

Brandefense tracks 52 threat actors attributed to Iran. The most documented are APT35, OilRig and MuddyWater. The sectors they target most are Government, Transportation and Logistics, and Manufacturing.

13 of 13 published profiles shown

APT35Iran
aka COBALT ILLUSION · ITG18 · Phosphorus +4
Nation-state APTIdeology

APT35 is an Iran-attributed nation-state APT group with an ideological motive.

179TTPs
50exploited
129malware
AdvancedProfile →
MuddyWaterIran
aka Boggy Serpens · Earth Vetala · MERCURY +15
Nation-state APTIdeology

MuddyWater is an Iran-attributed nation-state APT group with an ideological motive.

188TTPs
27exploited
186malware
AdvancedProfile →
Pioneer KittenIran
aka UNC757 · Parisite · RUBIDIUM +6
Nation-state APTIdeology

Pioneer Kitten is an Iran-attributed nation-state APT group with an ideological motive.

67TTPs
17exploited
39malware
AdvancedProfile →
HandalaIran
aka handala Team
RansomwareIdeology

Handala is an Iran-attributed ransomware group with an ideological motive.

72TTPs
1exploited
61malware
AdvancedProfile →
BlackshadowIran
aka Pink Sandstorm · AMERICIUM · Agonizing Serpens +3
RansomwareIdeology

Blackshadow is an Iran-attributed ransomware group with an ideological motive.

60TTPs
7exploited
16malware
AdvancedProfile →
MosesStaffIran
aka DEV-0500 · Marigold Sandstorm · Abraham's Ax +4
RansomwareIdeology

MosesStaff is an Iran-attributed ransomware group with an ideological motive.

40TTPs
1exploited
10malware
ModerateProfile →
IranIran
aka Iran-linked hackers
UnclassifiedIdeology

Iran is an Iran-attributed threat actor group with an ideological motive. It targets organisations in 4 countries, including the United States and China.

39TTPs
–No CVE data
48malware
AdvancedProfile →
Prince of PersiaIran
aka Infy · Operation Mermaid · APT-C-07
UnclassifiedIdeology

Prince of Persia is an Iran-attributed threat actor group with an ideological motive.

14TTPs
–No CVE data
8malware
AdvancedProfile →
Nemesis KittenIran
aka DEV-0270 · DireFate · Yellow Dev 23 +2
UnclassifiedIdeology

Nemesis Kitten is an Iran-attributed threat actor group with an ideological motive. It uses 14 MITRE ATT&CK techniques.

14TTPs
–No CVE data
7malware
AdvancedProfile →
Iranian Ministry of Intelligence and Security (MOIS)Iran
UnclassifiedIdeology

Iranian Ministry of Intelligence and Security (MOIS) is an Iran-attributed threat actor group with an ideological motive.

7TTPs
–No CVE data
1malware
AdvancedProfile →
UNC1860Iran
Nation-state APTIdeology

UNC1860 is an Iran-attributed nation-state APT group with an ideological motive. It targets 3 sectors, including Government and Manufacturing.

3TTPs
–No CVE data
16malware
AdvancedProfile →
xHuntIran
aka SectorD01 · Hive0081 · Cobalt Katana +1
UnclassifiedIdeology

xHunt is an Iran-attributed threat actor group with an ideological motive. It targets organisations in Kuwait. It uses 3 MITRE ATT&CK techniques.

3TTPs
–No CVE data
11malware
ExpertProfile →
Edalat-e AliIran
UnclassifiedIdeology

Edalat-e Ali is an Iran-attributed threat actor group with an ideological motive.

0TTPs
–No CVE data
0malware
Not ratedProfile →
On the Brandefense platform

IOC Feeds, YARA Rules And ATT&CK Navigator Exports For Every Actor.

Plus alerts when an actor in your sector starts exploiting a product you run, and detection rules you can load into your own tools.

Request A Demo

FAQ

Common Questions.