Iranian State-Linked Actors (IRGC/MOIS)
Iran, Islamic Revolutionary Guard Corps (IRGC) and Ministry of Intelligence and Security (MOIS)
- State organ
- IRGC and MOIS (varies by case)
- MITRE ATT&CK groups
- G0064
- Attribution basis
- Albania: on-record attribution to MOIS by Albania, the US and allies. Shamoon: assessed by US officials and researchers, never formally attributed.
Mission Type
Destructive signalling, political coercion, regional espionage, retaliatory operations
Primary Sectors
Operational Period
2012 – present
Attributed Cases
2
Attributed Cases
Activity Timeline
Attribution Basis
How firmly each operation is tied to this actor, and by whom. Confidence reflects the weight of public evidence, not intelligence-community ground truth (see methodology §08).
Attributed by Contested/Unknown, Academic/Private Sector · Consequences: No Formal Response
Attributed by US Government, Allied Coalition, Academic/Private Sector · Consequences: Sanctions, Diplomatic Expulsion, Public Naming
TTP Pattern Summary
Iranian actors deploy wiper malware for strategic signalling (Shamoon, Albania attacks), use hacktivist fronts for deniability, and conduct espionage through custom RATs. Operations frequently employ initial access through public-facing web applications followed by data destruction or exfiltration. Recent campaigns show improved operational security and diversification of tooling.
Behavioural Signature
Iranian operations are characteristically retaliatory and politically motivated, responding to perceived threats or grievances through destructive cyber demonstrations. The use of hacktivist fronts (Cutting Sword of Justice, Homeland Justice) provides deniability while ensuring the coercive message is received. Target selection reflects geopolitical relationships: Gulf states, Israel, and states hosting Iranian opposition groups.
Governance Footprint
Albania's diplomatic severance following the 2022 attack was the first rupture of diplomatic relations over a cyber operation. US sanctions imposed on MOIS and affiliated entities. Iranian operations have been central to debates on cyber deterrence and the effectiveness of diplomatic consequences for state-sponsored destructive operations.