Loading threat actor…
Rusty Boots is an unattributed intrusion cluster associated with Iran-related activity during the late-February 2026 war period. It has been observed demonstrating both espionage capability and destructive potential, distinguishing it from purely intelligence-gathering operations. Reported behavior includes deployment of a bootkit-style wiper and retention of destructive tooling for possible later use, indicating an ability to transition from covert access and collection to disruptive or destructive effects. Rusty Boots has been discussed alongside the cluster MoKhargosh as part of a broader spike in attacks against Israeli and other states perceived as hostile to Tehran. Publicly available information does not support a definitive attribution to a known named threat actor or state service, but the operational context places the cluster within the ecosystem of Iran-aligned or Iran-related hostile cyber activity. No additional confirmed aliases or sub-groups are currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.