Skip to content
Threat Feed
Subscribe

Tag

Iran

5 briefs RSS
high advisory

Midyear Assessment of Iran-Linked Cyber Threat Landscape

SentinelOne Labs' midyear assessment highlights that Iran-linked cyber operations, involving groups like MuddyWater/Seedworm, Screening Serpens, APT42, and persona groups such as Handala, focus on persistent access, espionage, and selective disruption, often leveraging social engineering, compromised service providers, and RMM abuse, with increasing risk to operational technology environments.

iran espionage destructive-malware social-engineering operational-technology rmm supply-chain threat-assessment +1
12t
high threat

Iran's MOIS Expands Handala Brand to Physical Threat Operations

Iran's MOIS has broadened the Handala brand to encompass physical threat operations, recruiting proxies to conduct attacks, espionage, and sabotage against US and Israeli interests, amplifying both cyber and physical threats.

MOIS iran handala physical-threat influence-operations
1r 1t
high threat

Screening Serpens APT Targets Tech and Defense Sectors with New RATs

The Iranian APT group Screening Serpens targeted the tech and defense sectors in the U.S., Israel, and the UAE between February and April 2026, deploying six new RAT variants from the MiniUpdate and MiniJunk V2 malware families, using tailored social engineering lures and AppDomainManager hijacking.

MiniUpdate +2 Screening Serpens APT Iran RAT MiniJunk DLL Sideloading AppDomainManager Cyberespionage
2r 3t
critical threat

TeamPCP's CanisterWorm Kubernetes Wiper Targeting Iran

TeamPCP's CanisterWorm is a newly identified Kubernetes wiper targeting Iranian infrastructure, indicating a politically motivated destructive attack.

TeamPCP kubernetes wiper iran canisterworm destructive-attack
2r 1t
medium advisory

Iranian Botnet Operation Exposed via Open Directory

An Iranian botnet operation utilizing a 15-node relay network and active C2 infrastructure was exposed through an open directory.

botnet iran C2
1r 1t 1i