Loading story…
A joint advisory from the FBI, U.S. Cyber Command Cyber National Mission Force, the U.S. Department of the Treasury, and the UK National Cyber Security Centre says cyber actors working on behalf of Iran’s Islamic Revolutionary Guard Corps are conducting social-engineering and phishing campaigns against personal and business accounts. The activity has targeted people connected to Iranian and Middle Eastern affairs, including current and former senior government officials, think tank personnel, journalists, activists, lobbyists, and more recently individuals associated with U.S. political campaigns. The operators reportedly impersonate trusted contacts, journalists, relatives, or email providers, build rapport over time, and then direct victims to credential-harvesting pages that also capture multi-factor authentication codes.
The advisory says successful compromises can lead to suspicious logins, unauthorized email forwarding rules, connections from unknown devices or applications, message theft and deletion, and attempts to pivot into additional accounts. Authorities urged organizations to strengthen phishing awareness, deploy anti-spoofing protections, disable external auto-forwarding where possible, monitor mailbox-rule changes, enable alerts for anomalous logins, and adopt phishing-resistant MFA, including hardware-backed authentication methods. The references provided did not supply usable details tying the second document to this activity, so the reported event is defined by the joint warning on IRGC-linked account targeting.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The FBI, U.S. Cyber Command Cyber National Mission Force, U.S. Treasury, and the UK National Cyber Security Centre published a joint advisory describing the IRGC-linked activity, indicators of compromise, historical malicious domains, and mitigation recommendations. The guidance highlighted suspicious logins, malicious forwarding rules, unknown device connections, message exfiltration, and the use of phishing-resistant MFA.
Cyber actors working on behalf of Iran's Islamic Revolutionary Guard Corps targeted personal and business accounts through social engineering, phishing pages, and theft of credentials and two-factor authentication codes. Targets included people connected to Iranian and Middle Eastern affairs such as officials, journalists, activists, think tank staff, lobbyists, and later individuals associated with U.S. political campaigns.
CISA, FBI and partner agencies released a joint advisory detailing Cl0p's exploitation of the MOVEit vulnerability, associated tactics, and recommended mitigations. The advisory formalized government guidance for organizations responding to the campaign.
Progress Software disclosed the MOVEit Transfer vulnerability and issued security updates and mitigation guidance for customers. Defenders were urged to patch immediately and restrict public exposure of vulnerable MOVEit instances.
The Cl0p ransomware gang began exploiting a SQL injection vulnerability in Progress MOVEit Transfer to steal data from internet-facing servers and extort affected organizations. The campaign was characterized as data theft and extortion rather than widespread encryption of victim systems.
4 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A previously unidentified threat group, dubbed **UNK_SmudgedSerpent**, conducted a series of targeted phishing attacks against U.S.-based academics and foreign policy experts between June and August 2025. The campaign coincided with heightened Iran–Israel tensions and leveraged lures related to Iranian domestic politics and the Islamic Revolutionary Guard Corps (IRGC). Attackers impersonated prominent U.S. foreign policy figures, including those from think tanks such as the Brookings Institution and the Washington Institute, to increase the credibility of their phishing attempts. The emails often initiated benign conversations before escalating to credential phishing, sometimes delivering malicious URLs disguised as Microsoft Teams installers that ultimately deployed legitimate Remote Monitoring and Management (RMM) tools like PDQ Connect. Proofpoint researchers noted that the tactics, techniques, and procedures (TTPs) used by UNK_SmudgedSerpent overlapped with those of established Iranian APTs, including TA453 (Charming Kitten), TA455 (Smoke Sandstorm), and TA450 (MuddyWater), but the precise attribution remains unclear. The group targeted over 20 subject matter experts focused on Iran policy, with some attacks involving additional social engineering steps such as identity verification requests. The campaign highlights the evolving sophistication of Iranian cyber espionage efforts and the persistent targeting of individuals shaping U.S. policy on Iran.
Jun 29, 2026
Iranian state-sponsored threat actors have intensified their cyber operations, targeting government officials, defense sector personnel, and dissidents through sophisticated espionage and disruptive campaigns. The APT42 group, linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), has launched the 'SpearSpecter' campaign, employing highly personalized social engineering tactics to compromise senior defense and government officials, as well as their family members. These operations involve building trust over extended periods and leveraging fake conference invitations or meetings to deliver malicious payloads. Other Iranian-linked groups, such as Ferocious Kitten, have focused on targeting dissidents and activists with spear-phishing attacks that deploy custom malware like MarkiRAT, which features advanced data exfiltration and persistence techniques. In parallel, the DEV-1084 group, operating under the 'DarkBit' persona and closely associated with the Iranian state-linked MERCURY group, has conducted ransomware campaigns that prioritize destruction over financial gain. These attacks combine on-premises encryption with the mass deletion of cloud resources, effectively wiping out victim environments and aligning with broader strategic objectives of disruption and psychological impact. Technical analysis has revealed shared infrastructure and tools between DEV-1084 and MERCURY, further solidifying the connection to Iran’s Ministry of Intelligence and Security (MOIS). These coordinated campaigns underscore the evolving threat landscape posed by Iranian APTs, which blend espionage, destructive attacks, and advanced social engineering to achieve their objectives.
Jul 12, 2026
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026