Related Threat Clusters
-
Widespread DNS Poisoning Campaign Targets Hotel Wi-Fi to Steal Credentials
A DNS poisoning campaign has compromised hotel and conference center Wi-Fi gateways to steal Microsoft 365 login credentials from corporate travelers. The campaign has been active since at least June 2026, affecting…
73 articles · Updated July 24, 2026 -
DarkSword iOS Exploit Chain Targets Mobile Devices Globally
The Google Threat Intelligence Group has identified DarkSword, a full-chain iOS exploit affecting versions 18.4 to 18.7. This exploit leverages multiple zero-day vulnerabilities, including CVE-2025-31277 and…
2 articles · Updated July 11, 2026 -
Iranian Hackers Target US Aviation with New Malware and SEO Poisoning
Iranian state-aligned hackers, known as Nimbus Manticore (UNC1549), have intensified cyberattacks against the US aviation sector amid the ongoing US-Iran military conflict. Utilizing career-themed phishing and a novel…
6 articles · Updated May 26, 2026 -
MuddyWater Targets U.S. Entities Amid Geopolitical Tensions
In early 2026, the Iranian APT group MuddyWater launched cyberattacks against U.S. banking, a major airport, and Israeli operations of a U.S.-based software company. The attacks intensified in March, coinciding with…
16 articles · Updated July 22, 2026 -
17 Iranians Charged in Cyber Theft Campaign Targeting U.S. Institutions
The U.S. Department of Justice has unsealed a superseding indictment against 17 Iranian nationals linked to the Mabna Institute, alleging a coordinated cyber theft campaign on behalf of Iran's Islamic Revolutionary…
55 articles · Updated August 18, 2026 -
Iranian Hackers Breach Los Angeles Transit System, Steal 700GB of Data
In March 2026, Iranian hackers linked to the Ministry of Intelligence and Security (MOIS) breached the Los Angeles County Metropolitan Transportation Authority (LACMTA), stealing at least 700 gigabytes of sensitive…
25 articles · Updated May 26, 2026 -
FBI Seizes Iranian Hacktivist Group Websites After Stryker Cyberattack
The FBI has seized two websites linked to the Iranian hacktivist group Handala following their cyberattack on Stryker Corporation, a U.S. medical technology firm. The attack, which occurred on March 11, 2026, involved…
21 articles · Updated March 19, 2026 -
Tortoiseshell Expands Malware Arsenal with New Backdoor and SSH Tunneling Tool
The Iranian-linked Tortoiseshell APT group has expanded its malware toolkit, introducing a new backdoor and reverse SSH tunneling utility. Group-IB Threat Intelligence identified these developments following a report by…
6 articles · Updated August 26, 2026 -
Iran War Causes Significant Damage to Gulf Energy Infrastructure
The ongoing war between Iran and Israel has severely impacted energy infrastructure across the Gulf region. Missile and drone strikes have damaged dozens of refineries, oil fields, and gas plants, leading to significant…
3 articles · Updated April 12, 2026 -
Coruna and DarkSword iOS Exploit Kits Targeting Users Globally
The Coruna and DarkSword iOS exploit kits, initially limited to nation-state actors, are now being widely adopted by organized cybercriminals. iVerify has tracked around 17,000 domains associated with second-generation…
3 articles · Updated August 10, 2026
Recent Intelligence Reports
- Why The Middle Easts Digital Identity Infrastructure Needs A Deeper Trust Layer — integratormedia.com · August 26, 2026
- Saudi Arabia issues deepfake guidelines as AI-driven identity threats rise — Biometricupdate · August 26, 2026
- Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel — Infosecurity-Magazine · August 26, 2026
- Deepfake trap: Group-IB warns Gulf investors over WhatsApp crypto & stock scams — Menatech · August 26, 2026
- GCC Space Cybersecurity Market (2024-2029) — Marketsandmarkets · August 22, 2026
- US charges 17 Iranians of cybertheft on behalf of IRGC — Thenewregion · August 19, 2026
- 17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the ... — Justice · August 18, 2026
- Us Iran War Trump Hormuz Houthi Attack Blockade — www.cnbc.com · August 14, 2026