Loading threat actor…
PRISONBREAK is an AI-enabled influence operation attributed to an Israeli-backed network that targeted Iranian audiences on social media. The campaign used a coordinated cluster of roughly 50 accounts on X to disseminate anti-government propaganda intended to incite unrest and encourage revolt against the Iranian government. Reported activity included the use of deepfakes and other AI-generated media, including fabricated wartime-style content designed to exploit periods of real-world tension and amplify psychological impact. PRISONBREAK is best characterized as a state-backed or state-aligned information operation rather than a conventional intrusion set or financially motivated cybercrime group. Its observed tradecraft centers on spoofing and influence activity through coordinated inauthentic behavior and synthetic media rather than network exploitation, ransomware, or destructive malware operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Prisonbreak is an AI-enabled influence operation believed to be run by the Israeli government, aiming to incite unrest in Iran by coordinating real-world events with social media disinformation and manipulation.
Prisonbreak is an AI-enabled influence operation believed to be run by the Israeli government, aiming to incite unrest in Iran by coordinating real-world events with social media disinformation, including AI-generated videos.
Coordinated Israeli-backed disinformation campaign using AI-generated content and deepfakes to destabilize Iran and foment revolt.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.