Loading story…
The U.S. Treasury sanctioned Iranian cyber group APT39, its front company Rana Intelligence Computing Company, and 45 associated individuals for supporting Iran’s Ministry of Intelligence and Security (MOIS) in a long-running intrusion and surveillance campaign. U.S. officials said the operation targeted Iranian dissidents, journalists, former officials, NGOs, academic institutions, foreign governments, intelligence services, airlines, and travel-sector companies across more than 30 countries, including roughly 15 U.S. companies, as part of Tehran’s intelligence and repression efforts.
At the same time, the FBI, in coordination with DHS/CISA and Treasury, published a TLP:WHITE alert detailing eight malware sets tied to Rana and APT39, also tracked as Chafer, Cadelspy, Remexi, and ITG07. The advisory described VBS, AutoIt, Python, BITS-based, Firefox-themed, and Android malware families, along with persistence methods, command-and-control behavior, indicators of compromise, and YARA rules to help defenders detect activity. One Android implant, Optimizer.apk, was reported to collect device data, record audio, take photos, and exfiltrate AES-encrypted data over HTTP POST via saveingone.com.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2020-09-17, the FBI, coordinated with DHS/CISA and the U.S. Treasury, released Alert ME-000134-MW on indicators of compromise associated with Rana Intelligence Computing Company, also tracked as APT39. The alert publicly detailed multiple malware families, indicators, and YARA rules tied to the campaign.
On 2020-09-17, the U.S. Treasury's Office of Foreign Assets Control sanctioned Iranian cyber threat group APT39, its front company Rana Intelligence Computing Company, and 45 associated individuals linked to Iran's Ministry of Intelligence and Security. The action blocked their property under U.S. jurisdiction and prohibited most transactions involving them by U.S. persons.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities indicted three Iranian nationals—**Said Pourkarim Arabi, Mohammad Reza Espargham, and Mohammad Bayati**—for cyber intrusions conducted between 2015 and 2019 against aerospace and satellite technology companies, alleging they stole sensitive commercial information, intellectual property, and personal data on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. Reporting on the case linked the activity to Iranian espionage tradecraft associated with **Elfin (`APT33`)**, including spear-phishing, use of the **NanoCore RAT**, exploitation of **`CVE-2018-20250`** in WinRAR, and follow-on intrusion activity using malicious HTA files, `mshta.exe`, and PowerShell in regional targeting such as Saudi Arabia. The enforcement action aligns with broader U.S. efforts against Iranian cyber operators, including **OFAC sanctions** on **APT39 (Chafer)**, the **Rana Intelligence Computing Company** front, and MOIS-linked personnel for surveillance and intrusions targeting Iranian citizens, neighboring governments, and foreign organizations. Separate threat research also described an Iranian espionage campaign dubbed **Operation GhostShell**, which targeted aerospace and telecommunications firms across the Middle East, the United States, Russia, and Europe with the **ShellClient** RAT, a stealthy backdoor that disguised itself as legitimate Windows components and in newer variants used the **Dropbox API** for command-and-control.
Aug 15, 2026
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026
Multiple reports detail **Iranian-linked espionage activity** and tooling updates. SafeBreach described follow-on findings on the Iranian state-sponsored actor **“Prince of Persia,”** including at least three active variants of **Foudre** and **Tonnerre** malware, newly identified C2 infrastructure, and a **Telegram-based data exfiltration** channel; after publication, the actor rapidly rotated C2 servers and Telegram accounts, attempted to obscure victim-tracking artifacts, and appeared to attempt a retaliatory action against researchers that resembled prior attacks against open-source Python libraries. Separately, Plone (a Python-based CMS) reported it **prevented a supply-chain compromise** after an attacker used a stolen developer **GitHub personal access token** to force-push whitespace-obfuscated malicious JavaScript into multiple repositories; the changes were detected before any official release, and GitHub assessed the payload was intended to compromise **other developers** (persistence via shell startup scripts, RCE, and theft of credentials/API keys/browser profiles/crypto wallet files). Additional Iranian activity was reported in an espionage campaign attributed to **APT42** (IRGC-linked) using **TAMECAT**, a modular, largely in-memory **PowerShell backdoor** delivered after prolonged social engineering (e.g., WhatsApp rapport-building), with modules for browser data theft, screenshots, and file discovery; however, separate research on the **Lazarus** “Contagious Interview” campaign (fake job interviews and AnyDesk RAT backdoors) is unrelated to the Iranian-focused activity described elsewhere.
Jun 29, 2026