Arcweb

Iran Cyber Attack Involves APTs and Hacktivist Proxies

First seen 3 Mar 2026, 17:10 UTC • •38.9

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

A coordinated cyber attack targeting Iran has been attributed to Advanced Persistent Threats (APTs) and hacktivist proxies. These groups, often state-funded, are known for executing sophisticated attacks on critical infrastructure. The incident highlights the ongoing risks posed by APTs in industrial cybersecurity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 218d ago How this analysis works

Timeline

2026-03-03

Cyber attack on Iran reported

2026-03-03

APT groups identified as key actors in the attack

Date unknown

Previous attacks by APTs mentioned, including ELECTRUM

Threat Graph

9 entities, 16 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (5)

Charming Kitten
CyberAv3ngers
Electrum
Sandworm
handala

Technique (2)

Malware
Ransomware

Organization (1)

Israel Opportunity Energy

Affected Platform (1)

Unitronics PLCs

Relationships

Charming Kitten uses Malware
Charming Kitten uses Ransomware
CyberAv3ngers uses Malware
CyberAv3ngers uses Ransomware
Electrum uses Malware
Electrum uses Ransomware
Sandworm uses Malware
Sandworm uses Ransomware
handala uses Malware
handala uses Ransomware
Charming Kitten targets Israel Opportunity Energy
CyberAv3ngers targets Israel Opportunity Energy
Electrum targets Israel Opportunity Energy
Sandworm targets Israel Opportunity Energy
handala targets Israel Opportunity Energy
Charming Kitten related to Unitronics PLCs

Following this threat?

Track handala, Charming Kitten and Israel Opportunity Energy in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed