CyberSIXT Search
Original
Image: SecurityOnline

SecurityOnlineDdos

UNMASKED: Massive Leak Exposes Iran’s ‘Department 40’ Cyber-Terror Unit

Part of the APT35 story · 6 articles · 3 outlets · since 30 Sep 2025

A significant leak of internal documents has exposed Iran's Department 40, a cyber unit linked to state-sponsored hacking and assassination plots. The leak reveals the identities and operations of over 60 operatives, led by commander Abbas Rahrovi, who uses various aliases. Department 40 is involved in sophisticated cyber operations, including phishing campaigns targeting journalists and dissidents, and curating 'target packages' for physical attacks.

Their methods include breaching airline and hotel databases, tracking targets through a proprietary surveillance platform, and coordinating with kinetic teams for attacks. The leak has compromised the unit's operations, revealing a structured hierarchy and global targeting, including plans against high-profile individuals and foreign governments.

Story timeline APT35

Full timeline
Show as table
APT35 coverage
Published (UTC)OutletHeadline
Thu 27 Nov 2025 · 00:51 UTCSecurityOnlineUNMASKED: Massive Leak Exposes Iran’s ‘Department 40’ Cyber-Terror Unit (this article)
Mon 22 Jun · 23:40 UTCdti.domaintools.comLeaked files show APT35 runs like a government department

Sources

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.

↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device