Loading threat actor…
Intelligence Group 13 is an Iranian state-linked cyber unit assessed to operate under the Islamic Revolutionary Guard Corps (IRGC). It has been described as a covert cyber strike element involved in cyber espionage, industrial sabotage, and psychological warfare, and as one of the more operationally aggressive components of the IRGC cyber apparatus. The group has been associated with offensive operations aligned with Iranian state interests and has been linked to the broader IRGC-linked ecosystem that includes CyberAveng3rs. Reported activity indicates a focus on disruptive and intelligence-driven operations rather than financially motivated crime. High-confidence reporting supports capabilities spanning reconnaissance, initial access, post-exploitation, persistence, defense evasion, and exfiltration in support of espionage and sabotage objectives.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Intelligence Group 13 is a covert Iranian cyber unit under the IRGC, responsible for cyber espionage, industrial sabotage, and psychological operations, including attacks on water authorities and SCADA systems in Israel and the U.S.
Iranian state-sponsored group conducting cyber intrusions and psychological operations, acting as the operational spearhead of the Shahid Kaveh Group within the IRGC.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.