Iran's primary intelligence agency, responsible for domestic security, counterintelligence, and cyber operations including hacking and espionage campaigns.
Operation Economic Outcast names nearly 60 targets, but the durable change is the standing authority to designate foreign firms in crypto, technology, gold, aviation and shipping.
Perspective Coverage
6 publishersReality
Group-IB says the Iran-linked leak-and-brag front Handala Hack runs HEAVYGRAM, a Python implant that takes orders from a Telegram bot, opens the microphone and lifts saved passwords after a loader writes Defender exclusions for it.
Perspective Coverage
9 publishersReality
A week of takedowns removed people and froze assets across five separate actions, while the kit that manufactures the stolen Microsoft 365 sessions those crews depend on still sells on Telegram for $320 a month.
Reality
Kaspersky says an Iranian-linked framework now picks its channel per transaction from a DNS record, and can swap the Google relay behind it. Allowlisted SaaS domains carry the traffic.
Reality
Minnesota's 30-plus plants and the FBI's seven states point at small municipal operators, and at a suspected Iranian campaign that no longer looks opportunistic.
Reality