Iranian Cyber Activity: Blurring Lines Between State Actors and Cybercrime

For years, Iranian intelligence services have leveraged criminal networks for deniable operations in the physical world. A similar pattern is now emerging in cyberspace, where state objectives are increasingly pursued through the tools, services, and operational models of the cybercrime ecosystem. This shift is particularly noticeable among actors linked to Iran’s Ministry of Intelligence and Security (MOIS).

From Cover to Collaboration: A Changing Landscape

Historically, Iranian actors have masked state-sponsored activity behind the guise of ordinary cybercrime, often posing as ransomware operators. However, the current trend goes beyond mere imitation. Rather than simply adopting criminal personas for attribution obfuscation, some Iranian actors are actively engaging with the cybercriminal ecosystem, utilizing its malware, infrastructure, and affiliate-style mechanisms. This evolution not only enhances deniability but also expands operational reach and technical capabilities.

MOIS and the Criminal Connection

The U.S. Treasury and the FBI have documented instances of cooperation between Iran’s intelligence services and criminal actors, predating the focus on digital arenas. These collaborations provided Tehran with reach, deniability, and access to individuals willing to carry out operations at arm’s length. Similar patterns have been observed in Sweden, where Iranian regime-linked criminal networks have been implicated in violent acts against perceived threats, including attacks targeting Israeli and Jewish interests. Iranian nation-state cyber actors remain a persistent and strategically motivated threat, known for targeting government agencies and critical infrastructure.

Void Manticore (Handala) and Rhadamanthys Infostealer

Void Manticore, an Iranian threat actor affiliated with MOIS, is a prominent group pursuing strategic objectives through cyber operations. Operating under hacktivist personas like Homeland Justice and Handala, it has been linked to disruptive attacks and “hack and leak” operations, particularly targeting Israel. Notably, Void Manticore has begun utilizing Rhadamanthys, a commercially available infostealer sold on darknet forums. Iran-linked actors are increasingly engaging with the cyber crime ecosystem.

Handala has deployed Rhadamanthys in phishing campaigns aimed at Israeli targets, often impersonating legitimate software updates, such as those from F5, and even the Israeli National Cyber Directorate (INCD). Despite international law enforcement efforts to disrupt Rhadamanthys infrastructure in November, including the seizure of 1,025 servers, the malware remains a threat.

MuddyWater and Criminal Tooling

MuddyWater, another MOIS-linked threat actor, has been conducting cyber espionage and malicious operations in the Middle East for years. Recent reports connect MuddyWater’s activities to several cybercrime clusters, creating confusion and potentially hindering accurate attribution. This demonstrates the effectiveness of using criminal software for obfuscation.

Specifically, MuddyWater has been linked to the Tsundere Botnet (also known as DinDoor) and the Castle Loader (FakeSet) malware families. The apply of code-signing certificates under the Common Names “Amy Cherne” and “Donald Gay” across MuddyWater malware, Tsundere Deno malware, and CastleLoader variants suggests a common source for these certificates, though it doesn’t necessarily indicate a direct affiliate relationship.

Qilin Ransomware and Strategic Objectives

In October 2025, the Shamir Medical Center in Israel was targeted in a cyberattack initially attributed to the Qilin ransomware group. However, subsequent assessments pointed to Iranian actors leveraging the Qilin ransomware-as-a-service (RaaS) operation to achieve strategic objectives. This suggests that Iranian-affiliated operators are utilizing criminal ransomware brands and methods to mask their activities and potentially circumvent heightened security measures.

This attack is part of a broader campaign by MOIS and Hezbollah targeting Israeli hospitals, a pattern evident since late 2023.

Conclusion

The examined cases demonstrate a clear shift in Iranian cyber activity. For some actors, cybercrime is no longer simply a cover for state-directed operations but an operational resource. Engagement with criminal tools and services enhances capabilities while complicating attribution. This trend highlights the increasing convergence between state-sponsored cyber activity and the cybercrime ecosystem.

Indicators of Compromise

• Handala Rhadmanthys Variants: aae017e7a36e016655c91bd01b4f3c46309bbe540733f82cce29392e72e9bd1f
• Malware samples signed with suspicious certificates: