Iranian MOIS-Linked Threat Actors Increasingly Leverage Cybercrime Tools and Infrastructure
Threat Actor Intelligence · 3 sources · Updated 4mo ago · First seen Mar 10, 2026
Check Point Research reported that Iranian Ministry of Intelligence and Security (MOIS)-linked actors are increasingly moving beyond simply posing as cybercriminals and are instead directly engaging with the cybercrime ecosystem—using criminal tooling, services, and operational models to support state objectives while complicating attribution. The activity is highlighted in operations tied to Void Manticore (including the Handala Hack persona) and MuddyWater, where researchers observed repeated overlaps with criminal tools and infrastructure, suggesting an affiliate-style or service-consumption model that improves resilience and capability.
Reporting on the research noted that Void Manticore has incorporated the commercially sold infostealer Rhadamanthys (marketed on cybercrime forums) into campaigns, including phishing activity targeting Israeli entities; the infostealer has been paired with custom wipers and lure themes such as impersonated F5 updates and even messages spoofing the Israeli National Cyber Directorate (INCD). The same coverage reiterated that MuddyWater continues MOIS-aligned espionage activity and is also associated with cybercrime-style tooling and services, reinforcing the assessment that Iranian state operators are increasingly blending state tradecraft with criminal malware, infrastructure, and monetized services rather than relying solely on false-flag “ransomware” or hacktivist branding.
