Cybersecurity articles tagged #Iran on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/u-s-sanctions-iran-linked-hackers-targeting-critical-infrastructurehttps://runtimerebel.com/blog/u-s-sanctions-iran-linked-hackers-targeting-critical-infrastructureU.S. Treasury sanctions Iran-linked cyber actors, including Mabna Institute members, for critical infrastructure breaches and cyber theft.Wed, 26 Aug 2026 00:41:56 GMTIranSanctionsCritical InfrastructureMOISCyber Espionagehttps://runtimerebel.com/blog/us-charges-iranian-hackers-in-3-4b-intellectual-property-thefthttps://runtimerebel.com/blog/us-charges-iranian-hackers-in-3-4b-intellectual-property-theftUS charges 17 Iranian hackers from Mabna Institute for a state-sponsored campaign stealing 31.5 TB of academic and corporate intellectual property since 2013.Wed, 19 Aug 2026 16:22:00 GMTIranCyber EspionageDOJMabna InstituteIntellectual Property Thefthttps://runtimerebel.com/blog/multistate-water-system-attacks-target-exposed-plcshttps://runtimerebel.com/blog/multistate-water-system-attacks-target-exposed-plcsAttacks targeting poorly secured, internet-exposed PLCs in water systems are widening across multiple U.S. states, with Iran suspected.Tue, 11 Aug 2026 08:46:26 GMTICSOT SecurityCritical InfrastructureIranWater Utilitieshttps://runtimerebel.com/blog/iran-backed-cyberattacks-target-minnesota-water-utilitieshttps://runtimerebel.com/blog/iran-backed-cyberattacks-target-minnesota-water-utilitiesIran-backed threat actors targeted over 30 Minnesota water utilities, highlighting critical infrastructure vulnerabilities. Learn about TTPs and mitigation strategies.Fri, 31 Jul 2026 02:56:58 GMTIranWater UtilitiesCritical InfrastructureICS OT SecurityMinnesotaNation Statehttps://runtimerebel.com/blog/diverse-threat-landscape-military-tracking-macos-malware-defense-ransomwarehttps://runtimerebel.com/blog/diverse-threat-landscape-military-tracking-macos-malware-defense-ransomwareAnalysis of diverse threats including reported Iranian tracking of US military phones, CrashStealer macOS malware, ransomware on a naval firm, and a Lidl data breach.Fri, 17 Jul 2026 17:14:58 GMTIranUS MilitaryCrashStealermacOS MalwareRansomwareNaval DefenseTKMSLidlData Breachhttps://runtimerebel.com/blog/ai-enhanced-cyber-operations-analyzing-iran-s-asymmetric-playbookhttps://runtimerebel.com/blog/ai-enhanced-cyber-operations-analyzing-iran-s-asymmetric-playbookAnalysis of how Iranian state actors integrate artificial intelligence into cyber operations, influence campaigns, and domestic surveillance for asymmetric gains.Thu, 16 Jul 2026 14:10:25 GMTIranArtificial IntelligenceAPTInfluence OperationsCyber Warfarehttps://runtimerebel.com/blog/iran-cyber-focus-expands-securing-internet-facing-vulnerabilitieshttps://runtimerebel.com/blog/iran-cyber-focus-expands-securing-internet-facing-vulnerabilitiesIranian state-sponsored cyber operations are broadening targets beyond critical infrastructure. All organizations must secure Internet-facing systems.Fri, 10 Jul 2026 03:33:44 GMTIranNation StateCyber EspionageVulnerability ManagementInternet Facing Vulnerabilitieshttps://runtimerebel.com/blog/iran-linked-hackers-deploy-new-cavern-c2-against-israeli-targetshttps://runtimerebel.com/blog/iran-linked-hackers-deploy-new-cavern-c2-against-israeli-targetsIranian state-sponsored threat actors are using a novel modular C2 framework, Cavern (Cav3rn), to compromise Israeli IT and government entities.Mon, 06 Jul 2026 21:38:48 GMTCavernCav3rnIranMOISIsraeli OrganizationsState SponsoredThreat Clusterhttps://runtimerebel.com/blog/iranian-nexus-tag-182-deploys-markirat-android-surveillancehttps://runtimerebel.com/blog/iranian-nexus-tag-182-deploys-markirat-android-surveillanceRuntime Rebel analyzes Iranian-nexus TAG-182's use of MarkiRAT malware. Disguised as fake VPN/media apps, it conducts cyber surveillance against domestic targets.Thu, 02 Jul 2026 07:41:52 GMTTAG 182MarkiRATIranCyber SurveillanceAndroid MalwareMobile ThreatAPThttps://runtimerebel.com/blog/iranian-russian-cyber-enabled-maritime-sanctions-evasion-tacticshttps://runtimerebel.com/blog/iranian-russian-cyber-enabled-maritime-sanctions-evasion-tacticsExplore the sophisticated cyber tactics used by Iranian and Russian shadow fleets to evade sanctions, leveraging fake maritime websites and fraudulent documents.Fri, 12 Jun 2026 09:43:20 GMTIranRussiaSanctions EvasionMaritime SecurityShadow FleetFraudDigital IdentityIllicit Shippinghttps://runtimerebel.com/blog/ofac-sanctions-nobitex-disrupting-ransomware-terror-financehttps://runtimerebel.com/blog/ofac-sanctions-nobitex-disrupting-ransomware-terror-financeThe U.S. Treasury sanctions Nobitex, Iran's largest crypto exchange, for facilitating terrorist financing and ransomware payments.Wed, 03 Jun 2026 21:10:45 GMTNobitexOFACSanctionsCryptocurrencyRansomwareIranTerrorist Financinghttps://runtimerebel.com/blog/handala-brand-evolution-iran-mois-shifts-to-hybrid-physical-attackshttps://runtimerebel.com/blog/handala-brand-evolution-iran-mois-shifts-to-hybrid-physical-attacksIran’s MOIS expands the Handala brand into hybrid operations, combining cyber espionage with physical sabotage targeting U.S. and Israeli interests.Tue, 02 Jun 2026 17:39:53 GMTHandalaMOISIranCyber PhysicalEspionageIsraelProxy Warfarehttps://runtimerebel.com/blog/iranian-apt33-targets-aviation-with-updated-mimicc2-and-powerlesshttps://runtimerebel.com/blog/iranian-apt33-targets-aviation-with-updated-mimicc2-and-powerlessIranian APT Nimbus Manticore (APT33) targets aviation and software firms using new MimicC2 framework and updated PowerLess tools for stealthy operations.Tue, 26 May 2026 20:46:55 GMTAPT33Nimbus ManticoreIranAviationSoftwareMimicC2PowerLessCyber EspionageCritical Infrastructurehttps://runtimerebel.com/blog/muddywater-2026-espionage-dll-side-loading-across-9-countrieshttps://runtimerebel.com/blog/muddywater-2026-espionage-dll-side-loading-across-9-countriesIranian group MuddyWater targets industrial manufacturing and financial sectors in a global 2026 espionage campaign using DLL side-loading techniques.Tue, 26 May 2026 17:14:39 GMTMuddyWaterAPT33DLL Side LoadingEspionageIranhttps://runtimerebel.com/blog/iranian-cyber-offensive-targets-critical-fuel-tank-gauge-systemshttps://runtimerebel.com/blog/iranian-cyber-offensive-targets-critical-fuel-tank-gauge-systemsIranian threat actors are targeting insecure automatic tank gauges in fuel infrastructure, posing risks of physical disruption and environmental damage.Mon, 18 May 2026 17:04:16 GMTIranATGCritical InfrastructureOT SecurityCyber Physicalhttps://runtimerebel.com/blog/muddywater-targets-south-korean-electronics-maker-in-espionage-campaignhttps://runtimerebel.com/blog/muddywater-targets-south-korean-electronics-maker-in-espionage-campaignIran-linked MuddyWater (Seedworm) group launched a cyber-espionage campaign against a major South Korean electronics maker and other global entities.Thu, 14 May 2026 00:55:56 GMTMuddyWaterSeedwormStatic KittenIranCyber EspionageSouth KoreaElectronics MakerAPThttps://runtimerebel.com/blog/us-strategic-pivot-cyber-risk-and-geopolitical-shift-analysishttps://runtimerebel.com/blog/us-strategic-pivot-cyber-risk-and-geopolitical-shift-analysisAnalysis of the US strategic shift toward force-driven security and its implications for cyber threats from China, Russia, Iran, and criminal groups.Thu, 30 Apr 2026 16:41:48 GMTGeopoliticsChinaRussiaIranTransnational Organized CrimeWestern Hemispherehttps://runtimerebel.com/blog/fast16-malware-analyzing-the-precursor-to-stuxnet-sabotagehttps://runtimerebel.com/blog/fast16-malware-analyzing-the-precursor-to-stuxnet-sabotageAnalysis of the Fast16 malware, a state-sponsored tool designed to sabotage high-precision mathematical simulations and physical computation processes.Thu, 30 Apr 2026 12:42:39 GMTFast16StuxnetIcs SabotageState SponsoredIranhttps://runtimerebel.com/blog/uk-cyber-chief-russia-iran-china-drive-top-cyber-threatshttps://runtimerebel.com/blog/uk-cyber-chief-russia-iran-china-drive-top-cyber-threatsNCSC warns British businesses of escalating cyber threats from state-sponsored groups in Russia, Iran, and China, urging preparedness for potential large-scale attacks.Wed, 22 Apr 2026 20:26:36 GMTUKNCSCRussiaIranChinaNation StateCyber WarfareCritical Infrastructurehttps://runtimerebel.com/blog/iran-geopolitical-tensions-cyber-implications-preparednesshttps://runtimerebel.com/blog/iran-geopolitical-tensions-cyber-implications-preparednessExamine the potential cybersecurity implications of escalating geopolitical tensions involving Iran, focusing on nation-state TTPs and organizational preparedness…Tue, 14 Apr 2026 20:28:00 GMTIranNation StateGeopolitical ThreatCyber WarfareCritical InfrastructureAPTThreat Intelligencehttps://runtimerebel.com/blog/iranian-actors-target-rockwell-plcs-4000-us-devices-exposedhttps://runtimerebel.com/blog/iranian-actors-target-rockwell-plcs-4000-us-devices-exposedIranian-linked cyber actors have identified nearly 4,000 exposed US industrial control systems, primarily Rockwell Automation PLCs, raising critical infrastructure…Fri, 10 Apr 2026 16:24:02 GMTIranRockwell AutomationPLCICSCritical InfrastructureCyberattacksExposurehttps://runtimerebel.com/blog/iran-linked-cyber-attacks-persist-despite-israel-hezbollah-ceasefirehttps://runtimerebel.com/blog/iran-linked-cyber-attacks-persist-despite-israel-hezbollah-ceasefireIran-affiliated threat actors maintain operational tempo against US critical infrastructure, disregarding kinetic pauses in Middle East regional conflicts.Thu, 09 Apr 2026 04:52:31 GMTIranIRGCCritical InfrastructureCyber Av3ngersICShttps://runtimerebel.com/blog/iran-linked-cyber-av3ngers-target-us-water-sector-plcshttps://runtimerebel.com/blog/iran-linked-cyber-av3ngers-target-us-water-sector-plcsUS federal agencies warn of Iran-linked Cyber Av3ngers targeting Unitronics PLCs in critical infrastructure. Learn how to detect and mitigate these OT attacks.Wed, 08 Apr 2026 04:54:42 GMTCyber Av3ngersPLCUnitronicsOT SecurityIranhttps://runtimerebel.com/blog/quantum-geopolitics-cyber-threats-in-an-era-of-iran-conflicthttps://runtimerebel.com/blog/quantum-geopolitics-cyber-threats-in-an-era-of-iran-conflictAnalyze how the shift toward quantum geopolitics and Iranian proxy conflicts impact global cyber stability and critical infrastructure protection.Thu, 02 Apr 2026 08:35:45 GMTIranGeopoliticsAPTMiddle EastCritical Infrastructurehttps://runtimerebel.com/blog/iranian-hackers-target-kash-patel-us-offers-10m-bountyhttps://runtimerebel.com/blog/iranian-hackers-target-kash-patel-us-offers-10m-bountyThe FBI confirms Iranian state-sponsored hackers compromised Kash Patel’s personal email, leading the U.S. to offer a $10M reward for information.Mon, 30 Mar 2026 08:42:33 GMTIranFBIKash PatelElection InterferenceState SponsoredAPThttps://runtimerebel.com/blog/iranian-linked-handala-group-breaches-kash-patel-s-personal-emailhttps://runtimerebel.com/blog/iranian-linked-handala-group-breaches-kash-patel-s-personal-emailFBI confirms Iranian-linked Handala hackers breached Director nominee Kash Patel's personal email, leaking documents and highlighting spear-phishing risks.Mon, 30 Mar 2026 00:41:00 GMTHandalaIranKash PatelFBISpear PhishingEspionagehttps://runtimerebel.com/blog/weaponized-surveillance-how-israel-hijacked-iran-s-camera-networkhttps://runtimerebel.com/blog/weaponized-surveillance-how-israel-hijacked-iran-s-camera-networkAnalysis of the compromise of Iran's surveillance infrastructure by Israel to facilitate kinetic targeting and high-value intelligence operations.Tue, 24 Mar 2026 12:24:55 GMTIranIsraelCCTV SecurityNation StateSurveillance Weaponizationhttps://runtimerebel.com/blog/teampcp-targets-kubernetes-clusters-with-iran-specific-wiper-malwarehttps://runtimerebel.com/blog/teampcp-targets-kubernetes-clusters-with-iran-specific-wiper-malwareTeamPCP is targeting misconfigured Kubernetes clusters to deploy a data-wiping script that specifically triggers on Iranian system configurations and locales.Mon, 23 Mar 2026 20:17:25 GMTTeamPCPKubernetesWiper MalwareCloud SecurityIranhttps://runtimerebel.com/blog/canisterworm-wiper-attacks-target-iran-via-cloud-misconfigurationshttps://runtimerebel.com/blog/canisterworm-wiper-attacks-target-iran-via-cloud-misconfigurationsAnalysis of the CanisterWorm wiper targeting Iranian systems through cloud service vulnerabilities, shifting from financial extortion to destructive operations.Mon, 23 Mar 2026 16:26:55 GMTCanisterWormIranWiperCloud SecurityData Destructionhttps://runtimerebel.com/blog/iranian-handala-group-leverages-telegram-for-malware-delivery-and-c2https://runtimerebel.com/blog/iranian-handala-group-leverages-telegram-for-malware-delivery-and-c2FBI alerts organizations to Handala, an Iranian MOIS-linked group using Telegram APIs for data exfiltration, ransomware, and wiper attacks across sectors.Mon, 23 Mar 2026 12:23:29 GMTHandalaIranTelegramMOISRansomwareWiper MalwareFBI Warninghttps://runtimerebel.com/blog/iranian-cyber-infrastructure-hardening-ahead-of-operation-epic-furyhttps://runtimerebel.com/blog/iranian-cyber-infrastructure-hardening-ahead-of-operation-epic-furyAnalysis of Iran's six-month buildup of US-based shell companies and resilient cyber infrastructure to survive kinetic strikes and maintain hacking operations.Thu, 19 Mar 2026 16:25:33 GMTIranEmennet PasargadEpic FuryInfrastructure HardeningState Sponsoredhttps://runtimerebel.com/blog/eu-sanctions-china-and-iran-entities-over-apt31-cyber-operationshttps://runtimerebel.com/blog/eu-sanctions-china-and-iran-entities-over-apt31-cyber-operationsThe European Union imposes sanctions on Chinese and Iranian entities linked to APT31 and state-sponsored cyber espionage targeting democratic institutions.Thu, 19 Mar 2026 08:18:51 GMTAPT31Wuhan XiaoruizhiSanctionsChinaIranCyber Diplomacyhttps://runtimerebel.com/blog/polands-nuclear-center-targeted-in-suspected-iranian-cyberattackhttps://runtimerebel.com/blog/polands-nuclear-center-targeted-in-suspected-iranian-cyberattackPolish officials investigate a cyberattack at the NCBJ nuclear center. Initial evidence points to Iran, but investigators warn of potential false flag tactics.Mon, 16 Mar 2026 12:25:26 GMTNCBJPolandCritical InfrastructureIranAPThttps://runtimerebel.com/blog/iranian-mois-collusion-with-cybercriminals-evolving-hybrid-threathttps://runtimerebel.com/blog/iranian-mois-collusion-with-cybercriminals-evolving-hybrid-threatIranian state-sponsored APTs, linked to MOIS, are now directly collaborating with cybercriminal organizations, escalating hybrid cyber operations. Defenders must adapt.Fri, 13 Mar 2026 00:35:19 GMTIranMOISNation StateCybercrimeAPTHybrid WarfareThreat Intelligencehttps://runtimerebel.com/blog/chinese-nexus-actors-pivot-to-qatar-geopolitical-espionagehttps://runtimerebel.com/blog/chinese-nexus-actors-pivot-to-qatar-geopolitical-espionageAnalysis of Chinese Nexus actors' shift to targeting Qatari entities amid Iranian conflict. Understand their adaptable TTPs and fortify defenses.Wed, 11 Mar 2026 16:31:22 GMTChinese Nexus ActorsQatarIranGeopoliticsEspionageNation State APThttps://runtimerebel.com/blog/stryker-wiper-attack-iran-backed-group-targets-medtech-operationshttps://runtimerebel.com/blog/stryker-wiper-attack-iran-backed-group-targets-medtech-operationsAnalysis of a destructive wiper attack claimed by an Iran-backed hacktivist group against medical technology firm Stryker, disrupting global operations.Wed, 11 Mar 2026 16:30:57 GMTIranWiper MalwareStrykerMedtechCritical InfrastructureDestructive AttackHacktivismhttps://runtimerebel.com/blog/iran-integrates-cyber-kinetic-operations-into-military-doctrinehttps://runtimerebel.com/blog/iran-integrates-cyber-kinetic-operations-into-military-doctrineIran is leveraging cyber operations, including IP camera exploitation, to support kinetic military strikes and physical asset targeting globally.Fri, 06 Mar 2026 16:23:44 GMTIranCyber KineticIot SecurityPhysical SecurityThreat Intelligencehttps://runtimerebel.com/blog/nation-state-cyber-operation-israel-s-compromise-of-iranian-traffic-camerashttps://runtimerebel.com/blog/nation-state-cyber-operation-israel-s-compromise-of-iranian-traffic-camerasAnalysis of the reported Israeli cyber operation targeting Iranian traffic cameras, detailing implications for critical infrastructure security and cyber-physical…Thu, 05 Mar 2026 20:17:25 GMTIsraelIranTraffic CamerasCyber EspionageNation State AttackCritical InfrastructureOT Securityhttps://runtimerebel.com/blog/iran-us-israel-cyber-conflict-geopolitical-cyber-threat-analysishttps://runtimerebel.com/blog/iran-us-israel-cyber-conflict-geopolitical-cyber-threat-analysisAnalysis of the ongoing US-Israeli strikes on Iran, covering cyber, physical, and geopolitical dimensions.Thu, 05 Mar 2026 00:36:15 GMTIranUSIsraelGeopolitical ConflictNation StateCyber Warfarehttps://runtimerebel.com/blog/geopolitical-strikes-on-aws-data-centers-mitigating-physical-disaster-riskhttps://runtimerebel.com/blog/geopolitical-strikes-on-aws-data-centers-mitigating-physical-disaster-riskIranian drone strikes damaged AWS data centers in UAE and Bahrain, highlighting critical vulnerabilities to physical disasters and the urgent need for geo-redundancy.Tue, 03 Mar 2026 20:12:52 GMTAWSData CenterPhysical AttackIranCloud SecurityDisaster RecoveryGeopolitical Threathttps://runtimerebel.com/blog/geopolitical-cyber-threat-iran-conflict-implications-for-defendershttps://runtimerebel.com/blog/geopolitical-cyber-threat-iran-conflict-implications-for-defendersAn analysis of the ongoing cyber, physical, and geopolitical components of the US-Israeli strikes on Iran and its implications for cybersecurity professionals.Tue, 03 Mar 2026 00:37:34 GMTIranGeopoliticsNation StateCyber ConflictThreat Intelligencehttps://runtimerebel.com/blog/iranian-cyberattack-risks-escalate-amid-middle-east-conflicthttps://runtimerebel.com/blog/iranian-cyberattack-risks-escalate-amid-middle-east-conflictThe NCSC warns UK organizations of increased Iranian state-sponsored cyber threats targeting critical infrastructure and utilizing advanced phishing tactics.Mon, 02 Mar 2026 16:18:24 GMTNCSCIranAPT33APT35Middle Easthttps://runtimerebel.com/blog/analysis-of-iran-s-2026-total-internet-shutdown-and-nin-architecturehttps://runtimerebel.com/blog/analysis-of-iran-s-2026-total-internet-shutdown-and-nin-architectureTechnical review of Iran's National Information Network and the shift toward total communications blackouts as a tool for state-level control.Fri, 27 Feb 2026 12:18:23 GMTIranNINInternet ShutdownGeopoliticsCensorshiphttps://runtimerebel.com/blog/muddywater-deploys-bugsleep-backdoor-in-targeted-regional-campaignshttps://runtimerebel.com/blog/muddywater-deploys-bugsleep-backdoor-in-targeted-regional-campaignsIranian state actor MuddyWater introduces the custom BugSleep backdoor, targeting Middle Eastern and African entities using spear-phishing and RMM abuse.Tue, 24 Feb 2026 08:22:38 GMTMuddyWaterBugSleepMOISSpear PhishingRMM AbuseIranCyber Espionage