Iran‑Linked Actors Forge Deeper Ties With Cybercriminal Networks

Iranian state-sponsored cyber actors are increasingly turning to the criminal ecosystem, deepening their ties with underground cybercrime groups.

This shift is particularly evident among the Ministry of Intelligence and Security (MOIS)-linked actors, such as Void Manticore (also known as “Handala Hack”) and MuddyWater.

By integrating criminal tools, services, and infrastructure into their operations, Iranian hackers are expanding their capabilities and complicating the attribution of their activities.

Evolving State-Sponsored Cyber Operations

For years, Iranian intelligence services have used cybercrime and hacktivism as cover for their covert operations.

Traditionally, Iranian cyber actors masked state-sponsored attacks by adopting criminal personas or mimicking common cybercrime tactics, such as using ransomware to obfuscate their true intentions.

However, recent activities reveal a more direct engagement with the criminal ecosystem, suggesting that for some Iranian groups, cybercrime is no longer just a cover story it has become a core operational resource.

In the past, the Iranian regime’s cyber actors primarily employed criminal methods as a form of camouflage to disrupt adversaries or carry out politically motivated attacks.

Now, these actors are leveraging tools and techniques from the criminal underground to extend their reach and capabilities.

This strategy enhances their technical ability and offers new ways to obscure the origin of the attacks, making it harder for defenders to trace the activities back to the Iranian state.

Key Examples Of Iranian-Criminal Nexus

One of the clearest examples of this new approach is the Void Manticore group, which has previously used “hacktivist” personas like Handala in cyberattacks.

This group is now known to employ commercial infostealers, like Rhadamanthys, which is widely sold on the dark web. The infostealer is used to compromise sensitive data before launching other disruptive operations, such as wipers, to destroy the targeted systems.

For example, Handala has used Rhadamanthys in phishing campaigns targeting Israeli organizations, including impersonating official updates to trick victims into downloading the malware.

Another prominent actor, MuddyWater, linked to MOIS, has expanded its cyber operations by tapping into cybercriminal clusters.

This overlap has been particularly noticeable in the Tsundere Botnet (also known as DinDoor), which uses both Node.js and Deno technologies commonly associated with cybercrime botnets.

The increasing collaboration between Iranian state actors and cybercriminal networks marks a significant shift in the operational strategies of nation-state threat groups.

By checkpoint utilizing criminal malware, ransomware tactics, and MaaS platforms, Iran is enhancing its cyber capabilities while complicating the attribution of malicious activities.

Type	Indicator	Associated Entity	Context / Use
SHA256 Hash	aae017e7a36e016655c91bd01b4f3c46309bbe540733f82cce29392e72e9bd1f	Void Manticore (Handala)	Rhadamanthys infostealer variant used in fake software updates ​.
Certificate Thumbprint	0902d7915a19975817ec1ccb0f2f6714aed19638	“Amy Cherne” (Fake Name)	Suspicious certificate used to sign FakeSet / CastleLoader malware ​.
Certificate Thumbprint	f8444dfc740b94227ab9b2e757b8f8f1fa49362a	“Donald Gay” (Fake Name)

As this trend continues, organizations must stay vigilant, recognize the shifting nature of cyber threats, and adapt to the increasingly complex web of actors involved in modern cyberattacks.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post Iran‑Linked Actors Forge Deeper Ties With Cybercriminal Networks appeared first on Cyber Security News.