Data Leak Outs Students of Iran's MOIS Training Academy

Data leak outs students of Iran’s MOIS training academy Ravin Academy, a sanctioned school tied to the government’s APT34 (MuddyWater). On 22 October 2025, British-Iranian activist Nariman Gharib published a list of more than 1,000 people associated with Ravin Academy to the open Web, exposing names and other personal data; according to The Register, the attack carries anti-Iranian hacktivist motives.

The leak includes students’ names, phone numbers, Telegram usernames and national ID numbers, with more details such as student IDs and class attendance not published. Ravin Academy was founded in November 2019 by two MOIS employees and is sanctioned by the US, UK and EU, with PwC outlining how the school published PoCs for CVE-2020-0688 and CVE-2020-1472 in 2020 and how MuddyWater exploited them in a later campaign.

The Tech Olympics event run at Tehran’s Pardis Technology Park reportedly involved more than 12,000 participants from 66 countries, with 1,100 travelling to Tehran for the final round, a context which underscores the academy’s broader national role.