Loading story…
CISA warned that Iranian government-sponsored and Islamic Revolutionary Guard Corps (IRGC)-affiliated cyber actors exploited unpatched Microsoft Exchange and Fortinet vulnerabilities to gain access to victim networks, establish persistence, and conduct follow-on malicious activity. The intrusions targeted internet-facing systems and relied on known vulnerabilities to move from initial compromise into broader enterprise environments, underscoring the continued risk from delayed patching of widely deployed edge and email infrastructure.
U.S. authorities said the activity evolved beyond espionage-style access into data extortion and disk encryption for ransom operations, with the same Iranian-linked operators using compromised networks to steal information and pressure victims for payment. The advisories tie the campaigns to state-backed Iranian actors and describe a pattern in which vulnerability exploitation on exposed systems enabled credential access, lateral movement, and disruptive impact across victim organizations.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
CISA published advisory AA22-257A stating that Iranian Islamic Revolutionary Guard Corps-affiliated cyber actors were exploiting vulnerabilities to steal data, extort victims, and encrypt disks in ransomware-style operations.
CISA published advisory AA21-321A warning that Iranian government-sponsored APT actors were exploiting Microsoft Exchange and Fortinet vulnerabilities to gain access to U.S. networks and conduct follow-on malicious activity.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA reported that Iran-based threat actors exploited known vulnerabilities in enterprise VPN products to gain initial access to victim networks, using exposed remote access infrastructure as a foothold for broader intrusion activity. The campaign highlighted the risk from unpatched perimeter devices and showed how state-linked operators can move from internet-facing appliances into internal environments, targeting organizations in the United States and elsewhere. A later CISA advisory said Iranian government-sponsored APT actors compromised a U.S. federal network and deployed a **cryptominer** alongside a **credential harvester**, indicating both opportunistic monetization and sustained access objectives. The activity tied together exploitation of public-facing weaknesses, credential collection, and post-compromise tooling, underscoring how Iranian operators have combined VPN exploitation with follow-on persistence and abuse inside victim networks.
Jul 12, 2026
Attackers exploited multiple zero-day and later related vulnerabilities in on-premises Microsoft Exchange Server to compromise email systems at tens of thousands of organizations worldwide, including government agencies, banks, universities, defense contractors, law firms, healthcare entities, local governments, and small businesses. Microsoft initially attributed the early activity to the China-linked group **Hafnium**, while CISA, the FBI, and the White House warned that exploitation quickly spread to many additional state-backed and criminal actors after patches were released. The intrusions affected Exchange 2010, 2013, 2016, and 2019 deployments rather than Exchange Online or Microsoft 365, and enabled attackers to steal emails and address books, dump credentials, install **web shells** such as **China Chopper**, move laterally, and in some cases deploy follow-on malware including ransomware. U.S. and allied governments later formally attributed the campaign to actors affiliated with China’s Ministry of State Security, as CISA said organizations should investigate for compromise dating back to at least January 2021 and assume identity compromise where exploitation was found. Security researchers and incident responders reported thousands of backdoored servers across more than 100 countries, with many systems still unpatched well after disclosure, and warned that patching alone did not remove implanted persistence. Microsoft and CISA released emergency updates, detection and remediation guidance, and tools including `Test-ProxyLogon.ps1` and `EOMT.ps1`, while later research showed Exchange attack chains such as **ProxyShell** could still be adapted for remote code execution and could evade weak perimeter defenses, reinforcing that rapid patching and thorough incident response were essential.
Jun 29, 2026
Leaked documents reviewed by Flashpoint indicate that Iranian contractor **Emen Net Pasargard (ENP)** ran a state-sponsored ransomware effort dubbed **Project Signal** on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. The material shows the operation progressing from reconnaissance by ENP’s Studies Center in mid-2020 to execution by its Cyber Directorate, with ransomware attacks beginning in late October 2020. The workflow included Bitcoin payment and decryption procedures, suggesting the campaign may have blended real extortion with an effort to disguise state activity as ordinary criminal ransomware; Flashpoint also noted similarities in timing and tradecraft to the Iran-linked **Pay2Key** campaign targeting Israeli organizations, while stopping short of confirming a direct connection. Separate reporting from Symantec described the sustained activity of **Elfin**/**APT33**, an Iran-linked espionage group that targeted at least 50 organizations across Saudi Arabia, the United States, and other countries in sectors including chemical, engineering, finance, telecoms, healthcare, and manufacturing. The group used spear-phishing, credential theft, commodity RATs, custom malware, and public tools, and in one case attempted to exploit **`CVE-2018-20250`** in WinRAR against a Saudi chemical-sector target. Together, the reports show Iranian operators using both long-term intrusion tradecraft for intelligence collection and ransomware-style operations that can support disruption, coercion, or plausible deniability.
Aug 15, 2026