Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| OilRigCHRYSENE, Greenbug, Hazel Sandstorm, EUROPIUM | Iran | Espionage | 2 | 2 | 82 | 30 | CyberSIXT · ATT&CK G0049 · MISP Galaxy |
| MuddyWaterTEMP.Zagros, Static Kitten, Seedworm, MERCURY | Iran | Espionage | 3 | 3 | 68 | 22 | CyberSIXT · ATT&CK G0069 · MISP Galaxy |
| APT35Newscaster Team, Magic Hound, Phosphorus, Mint Sandstorm | Iran | – | 9 | 9 | 78 | 13 | CyberSIXT · ATT&CK G0059 · MISP Galaxy |
| Nimbus ManticoreUNC1549, TA455, COBALT SMOKEY | Iran | – | – | – | 65 | 13 | CyberSIXT · ATT&CK G1059 · MISP Galaxy |
| Handala HackVOID MANTICORE, COBALT MYSTIQUE, Homeland Justice, Karma | Iran | – | 1 | 1 | 63 | – | CyberSIXT · ATT&CK G1055 · MISP Galaxy |
| APT39ITG07, Chafer, Remix Kitten, COBALT HICKMAN | Iran | – | – | – | 53 | 11 | ATT&CK G0087 · MISP Galaxy |
| APT33HOLMIUM, Elfin, Peach Sandstorm, MAGNALLIUM | Iran | Espionage | 3 | 3 | 34 | 16 | CyberSIXT · ATT&CK G0064 · MISP Galaxy |
| LyceumCOBALT LYCEUM, HEXANE, UNC1530, Spirlin | Iran | Espionage | – | – | 36 | 12 | CyberSIXT · ATT&CK G1001 · MISP Galaxy |
| APT42UNC788, CALANQUE, CALANQUE ION | Iran | Espionage | – | – | 33 | 2 | CyberSIXT · ATT&CK G1044 · MISP Galaxy |
| Fox KittenPioneer Kitten, Parisite, UNC757, Lemon Sandstorm | Iran | – | – | – | 41 | 5 | CyberSIXT · ATT&CK G0117 · MISP Galaxy |
| TortoiseshellIMPERIAL KITTEN, Yellow Liderc, TA456, DUSTYCAVE | Iran | Espionage | – | – | 19 | 1 | CyberSIXT · ATT&CK G1012 · MISP Galaxy |
| Fire AntPink Sandstorm, AMERICIUM, BlackShadow, DEV-0022 | Iran | – | 1 | 1 | 22 | 9 | CyberSIXT · ATT&CK G1030 · MISP Galaxy |
| CleaverThreat Group 2889, TG-2889, Operation Cleaver, Op Cleaver | Iran | Espionage | – | – | 5 | 4 | ATT&CK G0003 · MISP Galaxy |
| Rocket KittenTEMP.Beanie, Operation Woolen-Goldfish, Thamar Reservoir, Timberworm | Iran | Espionage | – | – | – | – | MISP Galaxy |
| CopyKittensSlayer Kitten | Iran | Espionage | – | – | 8 | 4 | ATT&CK G0052 · MISP Galaxy |
| InfyOperation Mermaid, Prince of Persia, Foudre | Iran | Espionage | – | – | – | – | CyberSIXT · MISP Galaxy |
| Shahid KavehCyber Av3ngers, Shahid Kaveh Group, Soldiers of Soloman | Iran | – | – | – | 17 | – | CyberSIXT · ATT&CK G1027 · MISP Galaxy |
| Ajax Security TeamOperation Woolen-Goldfish, AjaxTM, Rocket Kitten, Flying Kitten | Iran | Espionage | – | – | 6 | 2 | ATT&CK G0130 · MISP Galaxy |
| Moses StaffMarigold Sandstorm, DEV-0500, VENGEFUL KITTEN, DEV-500 | Iran | – | – | – | 12 | 4 | ATT&CK G1009 · MISP Galaxy |
| Mabna InstituteSilent Librarian, COBALT DICKENS, TA407, TA4900 | Iran | – | – | – | 13 | – | CyberSIXT · ATT&CK G0122 · MISP Galaxy |
| Storm-0842BANISHED KITTEN, DUNE, Red Sandstorm | Iran | Espionage, Destructive | – | – | – | – | CyberSIXT · MISP Galaxy |
| Cotton SandstormEmennet Pasargad, Holy Souls, MARNANBRIDGE, NEPTUNIUM | Iran | – | – | – | – | – | MISP Galaxy |
| Cutting KittenITsecTeam | Iran | Denial of service | – | – | – | – | MISP Galaxy |
| Charming KittenNewscaster, Parastoo, iKittens, Group 83 | Iran | Espionage | – | – | – | – | CyberSIXT · MISP Galaxy |
| MadiKaspersky Lab and Seculert worked together to sinkhole the Madi Command & Control (C&C) servers to monitor the campaign. Kaspersky Lab and Seculert identified more than 800 victims located in Iran, Israel and select coun | Iran | Espionage | – | – | – | – | MISP Galaxy |
| Ferocious KittenFerocious Kitten is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015. | Iran | – | – | – | 6 | 2 | CyberSIXT · ATT&CK G0137 · MISP Galaxy |
| GreenbugGreenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, government, investment, and education sectors. | Iran | – | – | – | – | – | MISP Galaxy |
| Bouncing GolfDomestic Kitten, APT-C-50 | Iran | – | – | – | 2 | 1 | ATT&CK G0097 · MISP Galaxy |
| Magic KittenGroup 42, VOYEUR | Iran | – | – | – | – | – | MISP Galaxy |
| TRACER KITTENIn April 2020, Crowstrike Falcon OverWatch discovered Iran-based adversary TRACER KITTEN conducting malicious interactive activity against multiple hosts at a telecommunications company in the Europe, Middle East and Afr | Iran | – | – | – | – | – | MISP Galaxy |
| Ababil of MinabAbabil of Minab is an emerging pro-Iranian hacktivist group with a limited public profile and little verifiable prior activity in threat intelligence reporting. The group claims responsibility for a cyberattack and alleg | Iran | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| AppMiladAppMilad is an Iranian hacking group that has been identified as the source of a spyware campaign called RatMilad. This spyware is designed to silently infiltrate victims' devices and gather personal and corporate inform | Iran | – | – | – | – | – | MISP Galaxy |
| APTIranAPTIran has claimed responsibility for a large-scale campaign targeting Israeli critical infrastructure, asserting infiltration of government ministries, hospitals, universities, and financial institutions as retaliation | Iran | – | – | – | – | – | MISP Galaxy |
| BladedFelineBladedFeline is an Iran-aligned APT group that has been active since at least 2017, targeting Iraqi and Kurdish government officials for cyberespionage. The group employs a variety of tools, including the Shahmaran backd | Iran | – | – | – | – | – | MISP Galaxy |
| CadelleSymantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014, however, it’s likely that activity began well before this date. Command-and-control (C&C) registrant information points to a | Iran | – | – | – | – | – | MISP Galaxy |
| Cavern ManticoreCavern Manticore APT | Iran | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| Clever KittenGroup 41 | Iran | – | – | – | – | – | MISP Galaxy |
| Cuboid SandstormDEV-0228 | Iran | – | – | – | – | – | MISP Galaxy |
| Cyber fighters of Izz Ad-Din Al QassamFraternal Jackal | Iran | – | – | – | – | – | MISP Galaxy |
| Cyber Islamic ResistanceCyber Islamic Resistance is a hacktivist collective ideologically aligned with Iran, engaging in operations such as website defacements, DDoS attacks, and data exfiltration targeting Israeli and Western entities. They ha | Iran | – | – | – | – | – | MISP Galaxy |
| Cyber ToufanCyber Toufan is a threat actor group that has gained prominence for its cyberattacks targeting Israeli organizations. The group's tactics suggest potential nation-state backing, possibly from Iran. They have been involve | Iran | – | – | – | – | – | MISP Galaxy |
| DarkBlindersDarkBlinders hackers are deploying a fake video meeting application to establish a backdoor and facilitate cyberespionage against Israel and the Kurdistan Region of Iraq. Their operations have led to compromises within a | Iran | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| DEV-0270Nemesis Kitten, Storm-0270 | Iran | – | – | – | – | – | MISP Galaxy |
| Edalat-e AliEdalat-e Ali is a hacktivist group known for disrupting Iranian state-run TV and radio transmissions during significant events, such as the Revolution Day ceremonies. They have also targeted government facilities, releas | Iran | – | – | – | – | – | MISP Galaxy |
| Educated ManticoreEducated Manticore is an Iranian APT group aligned with the Islamic Revolutionary Guard Corps, primarily engaged in espionage targeting government, military, and academic sectors. The group employs spear-phishing tactics | Iran | – | – | – | – | – | MISP Galaxy |
| Gray SandstormDEV-0343 | Iran | – | – | – | – | – | MISP Galaxy |
| Homeland JusticeHomeLand Justice is an Iranian state-sponsored cyber threat group that has been active since at least May 2021. They have targeted various organizations, including a well-known telecommunication company and the Albanian | Iran | – | – | – | – | – | CyberSIXT · MISP Galaxy |
| IRIDIUMResecurity’s research indicates that the attack on Parliament is a part of a multi-year cyberespionage campaign orchestrated by a nation-state actor whom we are calling IRIDIUM. This actor targets sensitive government, d | Iran | – | – | – | – | – | MISP Galaxy |
| Islamic Cyber Resistance in IraqIslamic Cyber Resistance in Iraq was named in one CyberSIXT article, which reports that 313 Team, also known by that name, claimed responsibility for a DDoS disruption of Bluesky. The claim was not independently verified | Iran | – | – | – | – | – | CyberSIXT |
| MalKamakMalKamak is an Iranian threat actor that has been operating since at least 2018. They have been involved in highly targeted cyber espionage campaigns against global aerospace and telecommunications companies. MalKamak ut | Iran | – | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-15.