Iranian State Cyber Operations

"The defendants conducted many of these intrusions on behalf of the Islamic Republic of Iran’s Islamic Revolutionary Guard Corps (IRGC), one of several entities within the government of Iran responsible for gathering intelligence, as well as other Iranian government and university clients."

"The Iranian-affiliated activity outlined in this advisory has disrupted PLCs across several U.S. critical infrastructure sectors by attempting to download malicious project files and manipulate data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss for affected organizations."

"Iranian hacking campaigns targeting equipment used across multiple U.S. critical infrastructure sectors are escalating in ​response to hostilities, U.S. cybersecurity, law enforcement and ‌intelligence agencies said on Tuesday."

"On or about July 15, 2022, and September 9, 2022, MOIS actors used the Justicehomeland[.]org domain to claim responsibility for stealing sensitive documents from Albanian government organizations."

"The FBI’s investigation also revealed that the email account Handala_Team@outlook[.]com was used to send death threats to Iranian dissidents and journalists living in the United States and abroad."

"As alleged in court documents, after the U.S.-Iran conflict began on February 28, 2026, the MOIS-controlled domains handala-hack[.]to and handala-redwanted[.]to published personally identifiable information (“PII”) associated with targeted individuals."

"The Justice Department announced the seizure of four domains as part of an ongoing effort to disrupt hacking and transnational repression schemes conducted by the Islamic Republic of Iran’s Ministry of Intelligence and Security (MOIS)."

"We are updating our analysis of a long-running influence campaign, known as "Endless Mayfly," to attribute this operation to Iran’s International Union of Virtual Media (IUVM), a US-sanctioned propaganda group with close ties to the Iranian government."

"We are updating our analysis of a long-running influence campaign, known as "Endless Mayfly," to attribute this operation to Iran’s International Union of Virtual Media (IUVM), a US-sanctioned propaganda group with close ties to the Iranian government."

"We terminated 27 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Azerbaijani that was critical of Azerbaijan."

"We terminated 15 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic that was supportive of the Iranian government."

"We terminated 69 YouTube channels and blocked 3 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic, Persian, Hindi and English that was supportive of the Iranian government and Palestine and critical of the US and Israel."

"We terminated 69 YouTube channels and blocked 2 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic, Persian, Hindi and English that was supportive of the Iranian government and Palestine and critical of the US and Israel."

"We terminated 12 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic that was supportive of the Iranian government and Palestine and critical of Israel."

"We banned recidivist activity associated with the likely Iranian-linked operation that we originally disrupted last August, tracked in the industry as STORM-2035."

"We removed a network that originated in Iran and targeted Azeri-speaking audiences in Azerbaijan and Turkey across multiple internet services including ours, X (formerly Twitter), YouTube, and on their own websites."

"We terminated 9 YouTube channels and blocked 6 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic and Farsi that was supportive of Iran’s government and Palestine and critical of Israel."

"We terminated 20 YouTube channels and 1 Ads account and blocked 6 domains from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic, Farsi, Hindi, and Urdu that was supportive of Palestine and the Iranian government and critical of Israel and the US."

"We banned five ChatGPT accounts that generated a small number of tweets and articles that were then posted on third party assets publicly linked to known Iranian influence operations."

"We also banned a ChatGPT account that generated tweets and articles that were then posted on third party assets publicly linked to two known Iranian IOs."

"The Cognitive Design Production Center (CDPC) is a subsidiary organization of the IRGC. Since at least 2023, CDPC planned influence operations designed to incite socio-political tensions among the U.S. electorate in the lead up to the 2024 U.S. elections, on behalf of the IRGC."

"We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English and Farsi that was supportive of Iran and Yemen and critical of Israel."

"We terminated 15 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic and Urdu that was supportive of Palestine and Iran and was critical of Israel and the US."

"We terminated 23 YouTube accounts, 1 AdSense account, 4 Blogger blogs, and blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English and Farsi that was supportive of Iran and Yemen and critical of Israel."

"Since October 2023, Iranian actors have used brute force and password spraying to compromise user accounts and obtain access to organizations in the healthcare and public health (HPH), government, information technology, engineering, and energy sectors."

"Microsoft Threat Intelligence assesses that Storm-0842, an Iranian Ministry of Intelligence and Security (MOIS) unit, launched another cyber persona, “KarMa,” the day after the war broke out,9 posing as Israelis seeking to remove Netanyahu from office."

"For example, a cyber-enabled influence operation run by an Islamic Revolutionary Guard Corps (IRGC) group we track as Cotton Sandstorm (also known as Emennet Pasargad) marketed stolen Israeli dating website data through two of its cyber personas between September 2023 and February 2024."

"Threat actor reported separately by Meta and Microsoft as originating in Iran, posting website articles and social media comments on topics that included the U.S. elections."

"We disrupted a network of accounts operated by an Iran-based threat actor, which based on an assessment from a credible source is attributable to STORM-0817."

"In late August, we disrupted a covert Iranian influence operation that generated social media comments and long-form articles about the U.S. election, alongside topics including the conflict in Gaza, Western policies towards Israel, politics in Venezuela, and Scottish independence."

"threat actors affiliated with the Iranian Government’s Islamic Revolutionary Guard Corps (IRGC) targeting and compromising accounts of Americans to stoke discord and undermine confidence in U.S. democratic institutions."

"We found this network as a result of our internal investigation and linked it to an Iranian threat actor, Cotton Sandstorm, which Microsoft previously connected to Iran's Islamic Revolutionary Guard Corps or IRGC."

"We terminated 4 YouTube channels and 1 Ads accounts as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Urdu, English, Farsi, Arabic and Bengali that was supportive of the Iranian government and Palestine and critical of Israel."

"We terminated 11 YouTube channels, 1 Ads accounts and 1 AdSense account as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic and English about current events in the Middle East, US and UK."

"We terminated 2 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English and Farsi that was supportive of the Iranian government and Palestine and critical of Israel."

"Emennet Pasargad, an Iranian cybersecurity company formerly known as Net Peygard Samavat Company, which attempted to interfere in the 2020 U.S. presidential election"

"Since at least May 2024, Masoud Jalili (Jalili) and other Iranian Islamic Revolutionary Guard Corps (IRGC) members compromised several accounts of officials and advisors to a 2024 presidential campaign and leaked stolen data to members of the media and other persons for the purpose of influencing the 2024 U.S. presidential election"

"Iranian state-sponsored actors have undertaken a variety of malicious cyber activities, such as hack-and-leak operations and spear-phishing, in an attempt to undermine confidence in the United States’ election processes and institutions while also seeking to influence the political campaigns." (US Department of State)

"FBI investigations conducted as recently as August 2024 assess that cyber actors like Pioneer Kitten are connected with the Government of Iran (GOI) and linked to an Iranian information technology (IT) company."

"An Iranian network, Storm-2035, comprising four websites masquerading as news outlets is actively engaging US voter groups on opposing ends of the political spectrum with polarizing messaging on issues such as the US presidential candidates, LGBTQ rights, and the Israel-Hamas conflict."

"Mint Sandstorm, a group run by the Islamic Revolutionary Guard Corps (IRGC) intelligence unit, sent a spear-phishing email to a high-ranking official of a presidential campaign from a compromised email account of a former senior advisor."

"Sefid Flood, an Iran-linked influence actor, began staging for influence operations in the 2024 US elections following the Iranian New Year in late March."

"We terminated 4 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English, Farsi and Arabic that was supportive of Iran, Yemen, Palestine and Islam and critical of Israel."

"We banned a small number of accounts linked to people associated with the International Union of Virtual Media (IUVM), an Iranian entity that has been studied by the open-source community since 2018."

"The IRGC-CEC, one of the Iranian government organizations behind malicious cyber activity, works through a series of front companies to target the United States and several other countries."

"This network originated in Iran and targeted Israel."

"We terminated 22 YouTube channels, 3 Blogger blogs, and 1 AdSense account as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English and Farsi that was supportive of Iran and Yemen and critical of Israel."

"We terminated 33 YouTube channels and blocked 1 domain from eligibility to appear on Google News surfaces and Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English, Spanish and Farsi that was supportive of Iran, Yemen, and Palestine and critical of the US and Israel."

"We terminated 4 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in English and Hebrew that was critical of the Israeli government and its actions in the ongoing Israel-Gaza war. The campaign also shared content depicting alleged cyber attacks targeting Israeli organizations."

"the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC), an Iranian government organization responsible for a series of malicious cyber activities against critical infrastructure in the United States and other countries."

"We terminated 40 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Azerbaijani and Farsi that was supportive of Iran’s government and critical of Israel and the US."

"We terminated 39 YouTube channels and 1 Blogger blog, and blocked 2 domains from eligibility to appear on Google News surfaces and Google Search Discover as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic that was supportive of the Islamic Republic of Iran."

"We terminated 14 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Hindi and Arabic that was supportive of the government of Iran."

"We terminated 8 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Hindi and Arabic with anti-Israel narratives."

"Note: This updated joint Cybersecurity Advisory reflects new investigative and analytic insights for network defenders on malicious cyber activities conducted by advanced persistent threat (APT) cyber actors affiliated with the Iranian Government’s Islamic Revolutionary Guard Corps (IRGC)."

"Early this year, we disrupted an Iranian CIB network that ran a series of fake “hacktivist” personas, and offered to publish allegedly hacked documents in countries including France."

"With that, we’ve now been able to link both the latest activity and originally unattributed operation to the Iranian state broadcaster, IRIB."

"We terminated 9 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing religious content in Bengali, Pashto and Arabic."

"1. Türkiye and Iran: We removed a network of 22 Facebook accounts, 21 Pages and seven Instagram accounts in Türkiye and Iran that targeted audiences in Türkiye."

"We terminated 3 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in French and English that was related to Iranian hack-and-leak operations. Our findings are similar to findings reported by Meta."

"We terminated 14 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaigns were sharing content about a variety of topics including content supportive of Palestine and critical of Israel."

"We terminated 6 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Arabic that was supportive of the Iran government."

"We terminated 40 YouTube channels as part of our investigation into coordinated influence operations linked to Iran. The campaign was sharing content in Farsi, English, Hindi and Urdu that was supportive of the Iranian government and critical of protesters in Iran. We received leads from Graphika that supported us in this investigation."