Loading story…
U.S. authorities indicted three Iranian nationals—Said Pourkarim Arabi, Mohammad Reza Espargham, and Mohammad Bayati—for cyber intrusions conducted between 2015 and 2019 against aerospace and satellite technology companies, alleging they stole sensitive commercial information, intellectual property, and personal data on behalf of the Islamic Revolutionary Guard Corps (IRGC). Reporting on the case linked the activity to Iranian espionage tradecraft associated with Elfin (APT33), including spear-phishing, use of the NanoCore RAT, exploitation of CVE-2018-20250 in WinRAR, and follow-on intrusion activity using malicious HTA files, mshta.exe, and PowerShell in regional targeting such as Saudi Arabia.
The enforcement action aligns with broader U.S. efforts against Iranian cyber operators, including OFAC sanctions on APT39 (Chafer), the Rana Intelligence Computing Company front, and MOIS-linked personnel for surveillance and intrusions targeting Iranian citizens, neighboring governments, and foreign organizations. Separate threat research also described an Iranian espionage campaign dubbed Operation GhostShell, which targeted aerospace and telecommunications firms across the Middle East, the United States, Russia, and Europe with the ShellClient RAT, a stealthy backdoor that disguised itself as legitimate Windows components and in newer variants used the Dropbox API for command-and-control.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
On 2020-09-17, the U.S. Treasury's OFAC added APT39, also known as Chafer, and Rana Intelligence Computing Company to the SDN List under the IRAN-HR program. OFAC identified both as linked to Iran's Ministry of Intelligence and Security and also designated numerous associated individuals.
On 2020-09-17, the FBI, coordinated with DHS-CISA, issued a Private Industry Notification on IRGC-associated cyber operations targeting U.S. and foreign aerospace, satellite, and international government organizations. The notice identified the indicted Iranian nationals, described their spear-phishing and follow-on intrusion methods, and published historical indicators and tooling including Metasploit, Mimikatz, NanoCore RAT, OCRA stagers, and a Python backdoor.
In late August 2019, Elfin compromised a victim in Saudi Arabia using a malicious HTA file delivered after the victim visited a malicious website in Microsoft Edge. The intrusion used mshta.exe and follow-on PowerShell activity to retrieve additional payloads from spoofed dynamic DNS infrastructure.
In June 2019, Elfin sent phishing emails to hundreds of recipients across multiple countries in an opportunistic trawling campaign. The emails linked to dynamic DNS infrastructure controlled by the group.
In February 2019, Elfin attempted to exploit CVE-2018-20250 in WinRAR to compromise an organization in Saudi Arabia's chemical sector. Symantec cited this as part of the group's recent operations.
Cybereason assessed that the Iranian threat actor it named MalKamak has operated since at least 2018. The group was later linked to espionage targeting aerospace and telecommunications organizations.
Cybereason assessed that the previously undocumented ShellClient RAT had been under active development since at least 2018. The malware later became the primary espionage tool in Operation GhostShell.
According to a U.S. indictment, Said Pourkarim Arabi, Mohammad Reza Espargham, and Mohammad Bayati carried out cyber attacks against aerospace and satellite technology companies between 2015 and 2019. The alleged operations used fake identities and spear-phishing to steal sensitive commercial information, intellectual property, and personal data on behalf of the IRGC.
Symantec said it has tracked the Iranian espionage group Elfin, also known as APT33, since late 2015. The group was associated with spear-phishing and scanning for vulnerable websites to gain access or support command-and-control operations.
Cybereason stated that the Operation GhostShell threat remained active as of September 2021. The campaign continued to use ShellClient for espionage against targeted organizations.
In July 2021, Cybereason investigated Operation GhostShell, a cyber-espionage campaign targeting aerospace and telecommunications organizations primarily in the Middle East, with additional victims in the United States, Russia, and Europe. During the investigation, researchers identified the ShellClient RAT and attributed the campaign to a newly named Iranian actor, MalKamak.
A ShellClient malware sample analyzed by Cybereason was compiled on 2021-05-22. The sample masqueraded as legitimate Windows binaries and supported stealthy espionage functions including Dropbox-based command-and-control.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
symantec-enterprise-blogs.security.com
Open sourcehome.treasury.gov
Open sourcecybereason.com
Open sourcesymantec.com
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury sanctioned Iranian cyber group **APT39**, its front company **Rana Intelligence Computing Company**, and 45 associated individuals for supporting Iran’s Ministry of Intelligence and Security (**MOIS**) in a long-running intrusion and surveillance campaign. U.S. officials said the operation targeted Iranian dissidents, journalists, former officials, NGOs, academic institutions, foreign governments, intelligence services, airlines, and travel-sector companies across more than 30 countries, including roughly 15 U.S. companies, as part of Tehran’s intelligence and repression efforts. At the same time, the FBI, in coordination with DHS/CISA and Treasury, published a **TLP:WHITE** alert detailing eight malware sets tied to Rana and APT39, also tracked as **Chafer**, **Cadelspy**, **Remexi**, and **ITG07**. The advisory described VBS, AutoIt, Python, BITS-based, Firefox-themed, and Android malware families, along with persistence methods, command-and-control behavior, indicators of compromise, and **YARA** rules to help defenders detect activity. One Android implant, `Optimizer.apk`, was reported to collect device data, record audio, take photos, and exfiltrate AES-encrypted data over HTTP POST via `saveingone.com`.
Aug 15, 2026
Leaked documents reviewed by Flashpoint indicate that Iranian contractor **Emen Net Pasargard (ENP)** ran a state-sponsored ransomware effort dubbed **Project Signal** on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. The material shows the operation progressing from reconnaissance by ENP’s Studies Center in mid-2020 to execution by its Cyber Directorate, with ransomware attacks beginning in late October 2020. The workflow included Bitcoin payment and decryption procedures, suggesting the campaign may have blended real extortion with an effort to disguise state activity as ordinary criminal ransomware; Flashpoint also noted similarities in timing and tradecraft to the Iran-linked **Pay2Key** campaign targeting Israeli organizations, while stopping short of confirming a direct connection. Separate reporting from Symantec described the sustained activity of **Elfin**/**APT33**, an Iran-linked espionage group that targeted at least 50 organizations across Saudi Arabia, the United States, and other countries in sectors including chemical, engineering, finance, telecoms, healthcare, and manufacturing. The group used spear-phishing, credential theft, commodity RATs, custom malware, and public tools, and in one case attempted to exploit **`CVE-2018-20250`** in WinRAR against a Saudi chemical-sector target. Together, the reports show Iranian operators using both long-term intrusion tradecraft for intelligence collection and ransomware-style operations that can support disruption, coercion, or plausible deniability.
Aug 15, 2026
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026