SecurityOnlineDdos
UNMASKED: Massive Leak Exposes Iran’s ‘Department 40’ Cyber-Terror Unit
A significant leak of internal documents has exposed Iran's Department 40, a cyber unit linked to state-sponsored hacking and assassination plots. The leak reveals the identities and operations of over 60 operatives, led by commander Abbas Rahrovi, who uses various aliases. Department 40 is involved in sophisticated cyber operations, including phishing campaigns targeting journalists and dissidents, and curating 'target packages' for physical attacks.
Their methods include breaching airline and hotel databases, tracking targets through a proprietary surveillance platform, and coordinating with kinetic teams for attacks. The leak has compromised the unit's operations, revealing a structured hierarchy and global targeting, including plans against high-profile individuals and foreign governments.
Story timeline APT35
Full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Thu 27 Nov 2025 · 00:51 UTC | SecurityOnline | UNMASKED: Massive Leak Exposes Iran’s ‘Department 40’ Cyber-Terror Unit (this article) |
| Mon 22 Jun · 23:40 UTC | dti.domaintools.com | Leaked files show APT35 runs like a government department |