Loading story…
An Iran-linked hacktivist group identified as Nasir Security, also known as Nasir Resistance, has allegedly leaked data stolen during a months-long breach of Dubai International Airport. Reports say the exposed material includes passport images belonging to Americans, Arabs, and Emiratis, along with photos of luggage contents and airport security scanner images. No confirmed evidence has emerged that airport operational systems or intelligence data were exposed, but the leaked personal records could be used for identity theft, fraud, and targeting of travelers.
The intrusion was reported amid a broader escalation in regional cyber activity following U.S.-Israel strikes against Iran, with researchers linking the campaign to a wider pattern of Iranian cyber operations. Separate reporting also noted activity by the Iranian state-backed group Seedworm, which has reportedly compromised multiple organizations, including a U.S. bank and another airport, underscoring concerns that transportation infrastructure and traveler data are becoming focal points in the expanding cyber conflict.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
On or before April 1, 2026, Nasir Security began publishing data it claimed was stolen from Dubai International Airport, including passport photos of Americans, Arabs, and Emiratis, luggage content images, and airport security scanner photos. Researchers warned the exposed personal data could facilitate identity theft and fraud.
Cybernews reported that the suspected Iran-linked hacktivist group Nasir Security, also known as Nasir Resistance, compromised Dubai International Airport over a period of months. The intrusion allegedly resulted in theft of passenger-related imagery and documents rather than sensitive operational or intelligence systems data.
Late-February U.S.-Israel joint missile strikes against Iran were cited as a trigger for an escalating cyber conflict in which subsequent hacktivist activity occurred.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-linked hackers operating as the **Handala Hack Team** claimed they breached FBI Director Kash Patel’s personal Gmail account and published excerpts from the stolen material online. Reporting says the leak totaled about **800 MB** and included personal photographs, a purported resume, and hundreds of emails, with exposed correspondence spanning roughly **2010 to 2019** and appearing to contain both personal and work-related messages. A Justice Department official confirmed Patel’s email account had been compromised and said the leaked material appeared authentic, though the emails themselves were not independently verified. Handala framed the intrusion as an embarrassment for U.S. security leadership and warned that if the FBI director could be compromised, other personnel could be targeted as well. Western cybersecurity researchers have assessed Handala as a pro-Palestinian hacktivist persona linked to **Iranian government cyberintelligence units**, and the breach follows other activity attributed to the group, including a claimed attack on medical technology company **Stryker**. The incident also comes after U.S. actions against Handala, including domain seizures and a **$10 million** reward offer tied to identifying members of the group.
Jun 29, 2026
Security researchers have attributed the March breach of the Los Angeles County Metropolitan Transportation Authority to an Iran-linked operation masquerading as the hacktivist group **Ababil of Minab**. Gambit Security said forensic evidence and infrastructure overlaps connect the activity to actors associated with Iran’s Ministry of Intelligence and Security, including clusters tracked as **MuddyWater**, **Black Shadow**, and **Static Kitten**. The attackers reportedly disrupted LA Metro’s payment environment, preventing riders from loading funds onto the agency’s mobile contactless payment app, while claiming they had stolen and deleted transit-system data. According to the report, the intrusion combined automation, hands-on-keyboard activity, and **ChatGPT-assisted scripting** to target IT, application, virtualization, and backup systems. Researchers said the attackers deleted virtual machines, wiped disks, and exfiltrated at least **700 GB** of emails and backups, forcing Metro to inspect roughly **1,400 servers** during recovery. Gambit linked the same actor to destructive incidents affecting **Tri-Rail**, **UNIMAC**, and **Vyncs**, reinforcing warnings that Iranian state-linked operators are using fake hacktivist branding to conduct disruptive attacks against critical infrastructure.
Jun 29, 2026
Lockheed Martin is facing extortion claims from the pro-Iran hacktivist group **APT Iran**, which said it stole **375 TB** of data from the U.S. defense contractor, including alleged **F-35** aircraft blueprints and other internal corporate files. The group publicized the alleged breach on Telegram and demanded more than **$400 million** to keep the material from being sold to U.S. adversaries, according to reporting cited by SC Media, Cybersecurity Dive, and UpGuard. A web archive of a post attributed to the **Handala Hack Team** showed the attackers escalating pressure by giving Lockheed Martin employees **48 hours** to respond. Lockheed Martin said it was aware of the reports and maintained that it has multilayered security controls in place, adding that it remains confident in the integrity of its information systems and data security. Flashpoint also linked the same threat actor to earlier attacks on Jordanian critical infrastructure, underscoring broader regional and geopolitical risk tied to the campaign.
Jun 29, 2026