Loading story…
The U.S. Treasury sanctioned five Iranian nationals for alleged cyber intrusions, data theft, and misuse of stolen business information tied to Iran’s Ministry of Intelligence and Security (MOIS). U.S. officials said the group had targeted critical infrastructure, government entities, and international organizations since at least late 2023, with victims spanning the energy, defense, healthcare, information technology, and finance sectors. Treasury said some of the accused also pursued personal financial gain and, in some cases, targeted Iranian companies in addition to foreign organizations.
The sanctions were announced amid broader U.S. and U.K. warnings about Iranian cyber activity affecting operational technology environments. Officials linked the action to ongoing concern over attacks on U.S. water systems and a reported disruption at a small British power plant, underscoring the risk to industrial control systems and programmable logic controllers (PLCs) used across energy, water, and agriculture. The move also aligns with a wider campaign against Iranian cyber operators, including a recently unsealed U.S. indictment involving alleged affiliates of the Tehran-based Mabna Institute.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
On Monday, the U.S. Treasury Department sanctioned four Iranians for alleged hacking and cyber-enabled theft against U.S. critical infrastructure and sanctioned Arman Kahzadian for allegedly receiving or using stolen business information. Treasury said the activity was directed by Iran's MOIS and that some members also pursued personal profit, including targeting Iranian companies.
The Treasury Department said the group compromised multiple local, state, and federal government offices across the United States during summer 2024.
Treasury said the accused individuals had conducted cyberattacks on behalf of Iran's Ministry of Intelligence and Security since at least late 2023, compromising and exfiltrating data from multiple U.S. companies. Targeted sectors included energy, defense, healthcare, information technology, and finance.
The Treasury Department said Behzad Mesri, identified as another leader of the MOIS-linked group, had previously been sanctioned in a 2018 action focused on the Mabna Institute.
The U.K. disclosed that Iranian hackers reportedly shut down a small British power plant for four days without causing outages, prompting renewed concern about operational technology security. Energy Minister Michael Shanks said the government briefed energy CEOs and shared additional security guidance with companies.
According to The Record, four of the sanctioned men were indicted the previous week for allegedly breaching employee email accounts linked to the U.S. Department of Labor, the Federal Energy Regulatory Commission, and multiple United Nations organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury launched **Operation Economic Outcast**, a sweeping sanctions campaign targeting the Iranian regime and its support network, designating nearly 60 entities, individuals, and vessels and issuing five sectoral sanctions determinations under Executive Order `13902`. Treasury also explicitly identified **digital assets** as a sanctionable Iranian sector, a move that raises secondary-sanctions exposure for exchanges and other firms that facilitate significant transactions involving Iranian digital asset businesses. A key cyber component of the action targeted five individuals tied to the Iran-based **Mabna Institute**, whose members were also charged by the U.S. Department of Justice for an alleged long-running hacking-for-hire operation conducted on behalf of the **IRGC** and other Iranian clients. OFAC published 30 cryptocurrency addresses linked to four Mabna defendants across **Bitcoin, Ethereum, and TRON**; blockchain analysis cited in reporting said the addresses received about **$16.8 million** since 2018, with roughly **92%** of the volume concentrated in wallets attributed to **Keyvan Fayaz**.
Aug 25, 2026
U.S. authorities indicted three Iranian nationals—**Said Pourkarim Arabi, Mohammad Reza Espargham, and Mohammad Bayati**—for cyber intrusions conducted between 2015 and 2019 against aerospace and satellite technology companies, alleging they stole sensitive commercial information, intellectual property, and personal data on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. Reporting on the case linked the activity to Iranian espionage tradecraft associated with **Elfin (`APT33`)**, including spear-phishing, use of the **NanoCore RAT**, exploitation of **`CVE-2018-20250`** in WinRAR, and follow-on intrusion activity using malicious HTA files, `mshta.exe`, and PowerShell in regional targeting such as Saudi Arabia. The enforcement action aligns with broader U.S. efforts against Iranian cyber operators, including **OFAC sanctions** on **APT39 (Chafer)**, the **Rana Intelligence Computing Company** front, and MOIS-linked personnel for surveillance and intrusions targeting Iranian citizens, neighboring governments, and foreign organizations. Separate threat research also described an Iranian espionage campaign dubbed **Operation GhostShell**, which targeted aerospace and telecommunications firms across the Middle East, the United States, Russia, and Europe with the **ShellClient** RAT, a stealthy backdoor that disguised itself as legitimate Windows components and in newer variants used the **Dropbox API** for command-and-control.
Aug 15, 2026
U.S. agencies warned that Iran could target **critical infrastructure** operators as researchers and policy analysts described a cyber ecosystem that blends state-directed activity with nominally independent hacktivist groups. CSIS said Tehran uses this structure to support espionage, sabotage, influence operations, and plausible deniability, citing the **CyberAv3ngers** intrusions into U.S. water and wastewater systems as a prominent example after U.S. authorities tied the activity to officials in the Islamic Revolutionary Guard Corps Cyber-Electronic Command. The same reporting linked Iranian state organs, including the **IRGC** and **MOIS**, to affiliated groups such as `APT33`, `APT35`, `APT34`/`OilRig`, and `MuddyWater`. The threat picture expanded as pro-Russia actors joined Iran-linked operations under **#OpIsrael**, with attacks reportedly including **DDoS**, claimed breaches, leaked CCTV footage, **SQL injection**, and data leaks against Israeli government, education, and municipal targets. Researchers said dozens of Russia-aligned and Iran-nexus actors appeared to be participating, while Radware separately reported retaliatory hacktivist DDoS activity tied to the regional conflict. U.S. officials and sector groups have monitored for spillover risk, warning that even if many operations are opportunistic or low sophistication, smaller U.S. infrastructure operators could still face disruptive, high-visibility attacks.
Jun 29, 2026