Loading threat actor…
Codebreakers is a hacker collective publicly associated with a March 2025 intrusion and extortion attempt targeting Bank Sepah, a government-owned Iranian bank with longstanding ties to Iran’s military and defense establishment. The group claimed it had infiltrated the bank’s systems, exfiltrated more than 12 terabytes of confidential data tied to over 42 million individuals, and then attempted to coerce payment by threatening disclosure. After the bank denied the breach, Codebreakers reportedly released sample data and additional records to substantiate its claims, indicating a data-theft-led extortion operation rather than a disruptive or destructive campaign. Reportedly exposed information included customer banking and personal data as well as records allegedly linked to military-affiliated individuals, making the operation notable for both its scale and its political sensitivity. The victim profile and the group’s public messaging indicate an operation focused on high-impact compromise of a strategically significant Iranian financial institution. Based on the available facts, Codebreakers has demonstrated capabilities in initial access, data exfiltration, post-compromise leverage through extortion, and public disclosure pressure. No high-confidence attribution to a state sponsor or a specific country of origin is currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Data theft and extortion operation attributed with stealing and leaking large volumes of banking customer records after ransom demands were rejected.
Actor claimed access to tens of millions of banking customer records and associated sensitive financial data; attribution and details are presented as claims in the content.
Claimed intrusion and large-scale data theft from Iran’s Bank Sepah, followed by extortion demand ($42M in Bitcoin) and selective leaking of purported customer/bank data after the bank denied the breach.
Claimed intrusion into Bank Sepah and exfiltration of large-scale customer and military-linked data; attempted extortion by threatening public release unless paid $42M in Bitcoin; later published sample data to substantiate claims.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.