Tag: iranian threat actor

3 Attack Reports | 0 Vulnerabilities

Attack reports

"Handala Hack" - Unveiling Group's Modus Operandi

Handala Hack, an online persona operated by Void Manticore, is affiliated with Iranian intelligence services. The group, known for destructive wiping attacks and hack-and-leak operations, has targeted organizations in Israel, Albania, and the US. Their tactics include supply chain attacks, credenti…

credential theft

iranian threat actor

Published: March 16, 2026

Downloadable IOCs: 7

Crossed wires: a case study of Iranian espionage and attribution

This analysis examines a newly identified threat actor dubbed UNK_SmudgedSerpent that targeted academics and foreign policy experts between June and August 2025. The actor used domestic political lures related to Iran, benign conversation starters, health-themed infrastructure, and Remote Managemen…

credential harvesting

iranian threat actor

attribution challenges

overlapping ttps

policy experts targeting

Published: November 5, 2025

Downloadable IOCs: 55

Peach Sandstorm deploys new custom Tickler malware in long-running intelligence gathering operations

Between April and July 2024, Iranian state-sponsored threat actor Peach Sandstorm deployed a new custom multi-stage backdoor called Tickler. The malware targeted organizations in the satellite, communications equipment, oil and gas, and government sectors in the United States and UAE. Peach Sandsto…

satellite sector

government targets

linkedin intelligence gathering

tickler malware

iranian threat actor

Published: August 30, 2024

Downloadable IOCs: 9

Click here to see more Attack Reports