Loading story…
The U.S. Treasury launched Operation Economic Outcast, a sweeping sanctions campaign targeting the Iranian regime and its support network, designating nearly 60 entities, individuals, and vessels and issuing five sectoral sanctions determinations under Executive Order 13902. Treasury also explicitly identified digital assets as a sanctionable Iranian sector, a move that raises secondary-sanctions exposure for exchanges and other firms that facilitate significant transactions involving Iranian digital asset businesses.
A key cyber component of the action targeted five individuals tied to the Iran-based Mabna Institute, whose members were also charged by the U.S. Department of Justice for an alleged long-running hacking-for-hire operation conducted on behalf of the IRGC and other Iranian clients. OFAC published 30 cryptocurrency addresses linked to four Mabna defendants across Bitcoin, Ethereum, and TRON; blockchain analysis cited in reporting said the addresses received about $16.8 million since 2018, with roughly 92% of the volume concentrated in wallets attributed to Keyvan Fayaz.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
On August 24, 2026, OFAC designated UAE-based Ukrainian national Ivan Obukhov for acting as a broker for Iranian shadow fleet vessels and facilitating sanctions evasion. Treasury said he had processed more than $100 million in cryptocurrency payments since 2023 to support IRGC-Qods Force oil sales.
In the August 24, 2026 designations, OFAC included five individuals tied to the Mabna Institute and published 30 cryptocurrency addresses belonging to four of the 17 defendants across Bitcoin, Ethereum, and TRON. TRM said the addresses had received roughly USD 16.8 million in total funds.
As part of the August 24, 2026 action, OFAC issued five sectoral sanctions determinations under Executive Order 13902 covering digital assets, technology, gold, aviation, and shipping. The digital-assets determination allows sanctions on persons or entities providing services in support of Iran's digital assets sector and raises secondary sanctions risk for firms processing significant transactions for Iranian exchanges or digital asset businesses.
On August 24, 2026, the U.S. Department of the Treasury launched Operation Economic Outcast, describing it as a whole-of-government economic campaign against Iran and its enablers. OFAC designated nearly 60 entities, individuals, and vessels tied to nuclear and missile procurement, cyber operations, and oil revenue generation.
On August 18, 2026, the Department of Justice unsealed a superseding indictment charging 17 members of the Mabna Institute with hacking-related offenses. The filing added eight defendants to the nine previously charged in 2018.
Treasury alleged that Mabna-linked actors began breaching and exfiltrating data from U.S. critical-infrastructure-sector companies in late 2023, including organizations in the energy, defense, healthcare, IT, and financial sectors.
TRM said activity on the 30 cryptocurrency addresses later listed by OFAC stretched back to January 2018. Ten addresses attributed to Keyvan Fayaz received funds between January 6, 2018 and August 20, 2026.
The superseding indictment states that nine of the 17 Mabna defendants had previously been charged in a 2018 indictment.
According to the Department of Justice, the Iran-based Mabna Institute conducted a coordinated hacking-for-hire campaign on behalf of the IRGC and other Iranian government and university clients since at least 2013.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcechainalysis.com
Open sourceinfosecurity-magazine.com
Open sourcetrmlabs.com
Open sourcehome.treasury.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Treasury's Office of Foreign Assets Control (**OFAC**) sanctioned four Tehran-based cryptocurrency exchanges—**Nobitex, Wallex, Bitpin, and Ramzinex**—along with several executives and founders, alleging they helped Iran evade sanctions and move regime funds through digital assets. Treasury said **Nobitex**, Iran's largest exchange, processed more than half of Iranian digital-asset inflows in 2025, enabled the Central Bank of Iran to access hundreds of millions of dollars in stablecoins, and facilitated transactions tied to the **Islamic Revolutionary Guard Corps (IRGC)**, including IRGC-affiliated ransomware operators and other illicit finance activity. The designations, issued under the Trump administration's **Economic Fury** campaign, freeze any sanctioned assets under U.S. jurisdiction and bar U.S. persons from dealing with the listed entities and individuals. Treasury described the move as the first time OFAC has individually placed an Iran-incorporated digital-asset exchange on the **SDN** list, while reporting that **Ramzinex** alone processed more than **$2.45 billion** in transactions and that Iran's crypto ecosystem received nearly **$7.8 billion** in 2025. The action expands U.S. pressure on Iranian financial networks that officials say support sanctions evasion, terrorism-linked finance, and ransomware-related transactions.
Jun 29, 2026
The U.S. Treasury sanctioned five Iranian nationals for alleged cyber intrusions, data theft, and misuse of stolen business information tied to Iran’s Ministry of Intelligence and Security (**MOIS**). U.S. officials said the group had targeted critical infrastructure, government entities, and international organizations since at least late 2023, with victims spanning the energy, defense, healthcare, information technology, and finance sectors. Treasury said some of the accused also pursued personal financial gain and, in some cases, targeted Iranian companies in addition to foreign organizations. The sanctions were announced amid broader U.S. and U.K. warnings about Iranian cyber activity affecting operational technology environments. Officials linked the action to ongoing concern over attacks on U.S. water systems and a reported disruption at a small British power plant, underscoring the risk to industrial control systems and **programmable logic controllers** (`PLCs`) used across energy, water, and agriculture. The move also aligns with a wider campaign against Iranian cyber operators, including a recently unsealed U.S. indictment involving alleged affiliates of the Tehran-based Mabna Institute.
Aug 25, 2026
The U.S. Treasury Department’s Office of Foreign Assets Control expanded sanctions on the **Central Bank of Iran** by adding four cryptocurrency wallet addresses as identifiers under an existing designation that also covers the **National Development Fund of Iran**. Treasury had previously sanctioned the bank and fund for providing financial support to the Islamic Revolutionary Guard Corps-Qods Force and other activities tied to Iran’s regional operations. Blockchain analysis cited in reporting said the newly listed wallets received more than **$165 million** in stablecoins, and **Tether** froze about **$131 million** linked to those addresses after the designation update. The action highlights U.S. efforts to disrupt alleged sanctions evasion through digital assets, with reporting stating that wallets attributed to the Central Bank of Iran have been used to move funds to regional partners including **Hezbollah** and that Tether has now frozen nearly **$475 million** tied to OFAC-identified Central Bank of Iran addresses.
Jul 16, 2026