Loading threat actor…
APT Iran is a pro-Iran hacktivist and state-aligned cyber persona active in the broader Iran-aligned online operations ecosystem. It has been associated with disruptive and propagandistic activity targeting Israel and regional states perceived as aligned with Israel or the United States, and some reporting links it to the Islamic Revolutionary Guard Corps, CyberAv3ngers, or an IRGC cyber command structure. The actor has also appeared alongside other Iran-aligned personas and coalitions such as Cyber Islamic Resistance, Handala, Dark Storm Team, DieNet, Keymous+, and the Electronic Operations Room of Islamic Resistance Axis. The group is known for public claims of attacks against Israeli organizations and critical infrastructure, increased mobilization on Telegram, and participation in retaliatory cyber campaigns following regional military escalation. Reported activity includes distributed denial-of-service attacks, website defacements, data exfiltration claims, ransomware or extortion-style claims, and alleged intrusions into operational technology and industrial-control environments. Claimed targets have included Israeli academic and government systems, Jordanian critical infrastructure, Gulf-state government and utility environments, U.S. defense-related entities, and water or power-sector systems. Several reports also describe APT Iran promoting or marketing an offensive OT framework with capabilities framed around industrial protocol scanning, exploitation, persistence, and electric-grid manipulation. Much of APT Iran’s publicly visible activity is claim-driven and amplified through social channels, and multiple incidents attributed to the persona remain unverified. Even so, the actor has been repeatedly associated with anti-Israel operations, disruptive campaigns, hack-and-leak behavior, and attempts to project capability against critical infrastructure and defense-sector targets. Known aliases include APTIran and APT IRAN.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
16 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as part of the broader coalition supporting pro-Iran cyber mobilization.
Iranian-affiliated espionage actor reportedly involved in exfiltrating and attempting to sell sensitive defense-sector data, including alleged Lockheed Martin/F-35-related information.
Iran-aligned persona observed operating through the Electronic Operations Room of Islamic Resistance Axis.
Pro-Iranian hacktivist/cyber persona using Telegram and a Russian-language darknet marketplace to promote an alleged Lockheed Martin data breach, inflate breach significance, and reactively change identity under perceived pressure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.