Loading story…
A significant data breach at Ravin Academy, a cybersecurity training center linked to Iran's Ministry of Intelligence and Security, resulted in the exposure of personal information belonging to over 1,000 individuals enrolled in its technical programs. The leaked records included usernames and phone numbers, and the incident was confirmed by the organization via its Telegram channel. Ravin Academy, established in 2019 and sanctioned by the U.S. Treasury in 2022 for supporting Iranian intelligence operations, offers courses in both defensive and offensive cyber skills, such as red-teaming, malware reverse engineering, and vulnerability analysis.
The full dataset was provided to U.K.-based activist Nariman Gharib, who published portions of the information online. The academy characterized the breach as an attempt to damage its reputation and undermine national cybersecurity efforts in Iran. This incident occurred amid heightened Iranian cyber activity and increased tensions with Israel and the U.S., including a surge in ransomware attacks targeting healthcare and public health organizations. The breach highlights ongoing risks to organizations involved in nation-state cyber operations and the potential for sensitive data exposure to impact both individuals and broader security initiatives.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting said the leaked material exposed the identities of students associated with the Iranian intelligence-linked training academy. This expanded the understood impact of the breach by highlighting personal exposure risks for attendees.
Ravin Academy publicly confirmed that it had experienced a data breach. The confirmation followed earlier reporting that the incident exposed sensitive records tied to the institution and its students.
An apparent breach affected Ravin Academy, an Iranian cybersecurity school reportedly linked to the Ministry of Intelligence and Security. Reporting indicates internal data was exposed, including information related to students and academy operations.
4 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcescworld.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran’s *Ariomex* cryptocurrency exchange suffered a significant **data leak** that exposed sensitive user and transaction information spanning **2022–2025**, according to findings published by **Resecurity**. The leaked database reportedly contained **11,826 customer records** (about **7,710** associated with Iran based on IP/network intelligence) and included user identities, email addresses, IP addresses, transaction histories, and contextual details about cryptocurrency operations; some records reportedly showed missing or altered **KYC** information despite high-value activity. Resecurity’s analysis also highlighted examples of suspicious, multi-million-dollar transactions and communications suggesting attempts to move large sums, and noted that some users appeared to treat the exchange as a de facto “bank” for storing crypto. Reporting indicated the exposure likely originated from a **compromised customer support system**, and the stolen data has been **circulating on dark web** channels. The dataset’s geographic indicators suggest Iranian crypto holders’ activity across multiple countries (including the US and several European jurisdictions), which could enable follow-on risks such as user identification, targeting, and potential investigative mapping of illicit financial activity. Separate coverage on Iran’s *Nobitex* exchange focused on market/chain-analysis and a prior 2025 hack, and did not describe the Ariomex leak itself.
Jun 29, 2026
A significant leak of internal operational documents allegedly belonging to the Iranian state-sponsored threat group APT35, also known as Charming Kitten, has surfaced online. The dataset, which appeared on a public repository in late September 2025, contains over 100 files of Persian-language internal documentation, including personnel rosters, tooling details, campaign reports, and organizational charts. Analysis of the leak reveals a highly coordinated structure within APT35, with dedicated teams for penetration testing, malware development, social engineering, and infrastructure compromise. The documents detail the group’s rapid exploitation of vulnerabilities such as CVE-2024-1709 and their use of mass router DNS manipulation to compromise targets. Victims identified in the leak span government, legal, academic, aviation, energy, and financial sectors, primarily in the Middle East, but also include targets in the United States and Asia. The operational materials highlight the group’s use of custom remote access trojans (RATs), advanced endpoint detection and response (EDR) evasion techniques, and supply-chain attack vectors. The leak also exposes the group’s sophisticated phishing infrastructure and their ability to achieve long-term persistence and Active Directory dominance within compromised environments. The documents provide insight into the group’s vulnerability research activities, targeting platforms such as Confluence, WordPress, Ivanti, and Apache. Additionally, the leak includes open-source intelligence (OSINT) on targets and detailed attack reports, including domain information and mentions of remote access tools like Anydesk. The individual or group responsible for the leak, operating under the alias KittenBuster, has stated their intention to release further evidence and personal information about APT35 members in the coming days. Security researchers are working to verify the authenticity of the leak, but initial assessments indicate a high degree of credibility based on language, content, and context. The exposure of these materials represents a rare and valuable opportunity for the cybersecurity community to gain insight into the tradecraft, organizational structure, and operational priorities of a major Iranian cyber-espionage group. The leak underscores the acute supply-chain and national security risks posed by IRGC-affiliated actors and highlights the need for heightened vigilance among organizations in targeted sectors. The ongoing release of additional documents may further illuminate the group’s tactics, techniques, and procedures (TTPs), enabling defenders to better anticipate and mitigate future threats. This incident marks one of the most comprehensive public exposures of Iranian APT operations to date, with potential implications for both regional and global cybersecurity.
Jun 29, 2026
VentureEd Solutions fixed a vulnerability in *Ravenna Hub*, a student admissions and application-tracking platform used across thousands of schools, after it was found to expose sensitive information about children and their families. The issue was an **insecure direct object reference (IDOR)** that allowed any authenticated user to access other users’ records by modifying sequential student identifiers in the URL, enabling access to data beyond their own account. Exposed information included children’s **names, dates of birth, home addresses, photos, and school details**, along with parents’ **email addresses and phone numbers** and information about siblings. VentureEd’s CEO said the company was able to reproduce the issue and remediated it after being alerted, but the company did not clearly commit to user notification and did not confirm whether it can determine if improper access occurred; it also declined to provide details on third-party security testing or internal cybersecurity oversight.
Jun 29, 2026