Loading...
Loading...
Iran operates multiple cyber units under the IRGC and Ministry of Intelligence, conducting espionage, destructive attacks, and influence operations against American targets while masquerading as hacktivists.
"Hacktivists" Are Often State Actors
Iranian state actors frequently create fake hacktivist personas to conduct attacks while maintaining plausible deniability. Groups like "CyberAv3ngers" have been traced directly to IRGC military units.
CyberAv3ngers operator
Focus: Critical infrastructure attacks, OT/ICS targeting
Notable: 2023-2024 US water utility campaign; 6 officials sanctioned by Treasury
Likely IRGC-affiliated
Focus: Aviation, energy, petrochemical sectors
Notable: Shamoon wiper attacks, Saudi Aramco targeting
Ministry of Intelligence (MOIS)
Focus: Government, finance, energy espionage
Notable: Middle East targeting, credential harvesting
IRGC Intelligence Organization
Focus: Journalists, activists, US officials
Notable: 2020 election interference attempts, credential phishing
IRGC Intelligence Organization
Focus: Surveillance of dissidents, credential theft
Notable: Long-term surveillance operations, mobile malware
Likely MOIS-affiliated
Focus: Government, telecoms, defense
Notable: Middle East and global targeting, PowerShell attacks
Fake personas operated by Iranian intelligence
Real: IRGC-CEC
Claimed Identity
Pro-Palestinian hacktivists
Actual Activity
State-directed infrastructure attacks
Status
Operators sanctioned Feb 2024
Real: IRGC-linked
Claimed Identity
Albanian opposition hacktivists
Actual Activity
Destructive attacks on Albanian government
Status
Active; caused diplomatic break
Real: IRGC-linked
Claimed Identity
Anti-Israel hacktivists
Actual Activity
Wiper malware against Israeli targets
Status
Active
Critical infrastructure
Oil, gas, electric
Defense, state agencies
Journalists, activists
Secure OT systems, implement strong authentication, and monitor for suspicious activity to defend against state-sponsored attacks.