Iranian-linked cyber operations against infrastructure

Cyberespionage and disruptive operations linked to Iranian actors have targeted critical infrastructure across several regions. An operation identified as ‘Blinder Tunnel’ utilized sophisticated malware, such as ShelbyLoader V2 and a decoy application named StarkMeet, to target government entities and infrastructure in Israel and the Kurdistan Region of Iraq. This campaign involved the exfiltration of significant government cloud data and utilized GitHub’s API for command-and-control communications.

Parallel or subsequent operations linked to the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence (MOIS) have targeted United States infrastructure, specifically impacting the healthcare and water supply sectors. Groups such as the Handala Hack Team have claimed responsibility for seizing personal information of U.S. servicemembers and targeting high-level government communications. These activities have resulted in practical disruptions, including hospital surgery delays and water advisories in various American towns.