iranian_state_sponsored_threat_actors

Iranian state-sponsored threat actors are engaged in a range of cyber operations including espionage, hack-and-leak, and destructive campaigns, with a focus on targets in Europe, the United States, Israel, and Ukraine. These actors often masquerade as hacktivists to obscure their state affiliation and have been observed leveraging AI and large language models (LLMs) for cyber operations such as phishing, reconnaissance, and online deception. Their campaigns are frequently driven by geopolitical conflicts, particularly those involving Israel and Hamas, and are known to target government, defense, infrastructure, and critical sectors. Iranian actors have also been reported to use AI to automate attacks, generate fake online content, and conduct disinformation campaigns. They are part of a broader ecosystem of state-sponsored adversaries from Russia, China, and North Korea, all of whom have expanded their targeting in Europe and the U.S. in recent years. Iran denies involvement in such operations at the state level, but high-confidence reporting consistently attributes these activities to Iranian state interests.