Tag: iranian threat actor

2 Attack Reports | 0 Vulnerabilities

Attack reports

Crossed wires: a case study of Iranian espionage and attribution

This analysis examines a newly identified threat actor dubbed UNK_SmudgedSerpent that targeted academics and foreign policy experts between June and August 2025. The actor used domestic political lures related to Iran, benign conversation starters, health-themed infrastructure, and Remote Managemen…

credential harvesting

iranian threat actor

attribution challenges

overlapping ttps

policy experts targeting

Published: November 5, 2025

Downloadable IOCs: 55

Peach Sandstorm deploys new custom Tickler malware in long-running intelligence gathering operations

Between April and July 2024, Iranian state-sponsored threat actor Peach Sandstorm deployed a new custom multi-stage backdoor called Tickler. The malware targeted organizations in the satellite, communications equipment, oil and gas, and government sectors in the United States and UAE. Peach Sandsto…

satellite sector

government targets

linkedin intelligence gathering

tickler malware

iranian threat actor

Published: August 30, 2024

Downloadable IOCs: 9

Click here to see more Attack Reports