iranian_nation_state_actors
Iranian nation-state cyber actors (no specific sub-groups or aliases named in the provided content). Reporting cited in the content indicates these actors conduct intrusions for intelligence collection and operational support, including gathering real-time intelligence used to enable or support non-cyber military operations (e.g., facilitating missile strikes). The content also states Iran blends espionage, disruption, and influence operations, including the use of AI-generated content for propaganda. Additionally, Microsoft reporting referenced in the content notes Iranian threat actors have increased ransomware attacks as part of influence operations. No further high-confidence details on specific tooling, victimology, or TTPs beyond these points are directly provided.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Earlier this April, another remote code execution vulnerability in the same product (CVE-2023-27350, CVSS score: 9.8)... came under widespread exploitation in the wild to deliver Cobalt Strike and ransomware.
...and an information disclosure flaw (CVE-2023–27351) came under widespread exploitation in the wild to deliver Cobalt Strike and ransomware. Iranian nation-state actors were also spotted abusing the bugs...
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting cyber intrusions to gather real-time intelligence in support of kinetic military operations, such as missile strikes.
Iranian nation-state actors blend espionage, disruption, and influence operations, using AI-generated content for propaganda and fake news to support regional objectives.
Iranian nation-state actors have increased their activity, now using ransomware as part of influence operations to further their geopolitical objectives.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.