Data Leak Exposes Iranian Cybersecurity Academy Trainees

First seen 2 Dec 2025, 18:33 UTC • Theregister

•79% similarity •25

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Ravin Academy, a training institution for Iranian state hackers, experienced a data breach that revealed the identities of over 1,000 individuals associated with the academy. The leak was publicized by British-Iranian activist Nariman Gharib on October 22, 2025, highlighting vulnerabilities in the academy's cybersecurity measures.

ThreatCluster AI

Attack Flow

10 entities, 22 inferred relationships (STIX 2.1).

Threat Actor (4)

Apt34
Helix Kitten
MuddyWater
OilRig

Technique (2)

Data Breach
Remote Code Execution

Organization (1)

Ravin Academy

Vulnerability (2)

CVE-2020-0688
CVE-2020-1472

Affected Platform (1)

Microsoft Exchange

Relationships

Apt34 uses Data Breach
Apt34 uses Remote Code Execution
Helix Kitten uses Data Breach
Helix Kitten uses Remote Code Execution
MuddyWater uses Data Breach
MuddyWater uses Remote Code Execution
OilRig uses Data Breach
OilRig uses Remote Code Execution
Apt34 exploits CVE-2020-0688
Apt34 exploits CVE-2020-1472
Helix Kitten exploits CVE-2020-0688
Helix Kitten exploits CVE-2020-1472
MuddyWater exploits CVE-2020-0688
MuddyWater exploits CVE-2020-1472
OilRig exploits CVE-2020-0688
OilRig exploits CVE-2020-1472
CVE-2020-0688 targets Microsoft Exchange
CVE-2020-1472 targets Microsoft Exchange
Apt34 targets Ravin Academy
Helix Kitten targets Ravin Academy
MuddyWater targets Ravin Academy
OilRig targets Ravin Academy

Community

Browse all →

Data Leak Exposes Iranian Cybersecurity Academy Trainees

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading