Iran‑Linked Hackers Tap Criminal Ecosystem to Bolster State Cyber Ops

Iran-linked cyber actors are increasingly working with the broader cybercrime ecosystem, using criminal tools, infrastructure, and business models to support state-backed operations and hide their involvement.

For years, Iranian intelligence services have relied on criminal intermediaries in the physical world to conduct surveillance, kidnappings, and assassination plots, gaining reach and plausible deniability.

The U.S. Treasury, for example, has sanctioned the narcotics network led by Naji Ibrahim Sharifi-Zindashti, describing it as operating at the behest of MOIS to target dissidents abroad.

A similar pattern is now visible online, as MOIS-linked cyber actors increasingly pursue state objectives by tapping into cyber criminal marketplaces, access brokers, and shared infrastructure rather than acting purely through bespoke, state-owned tooling.

This shift is clearest among Ministry of Intelligence and Security (MOIS)-linked groups such as Void Manticore and MuddyWater, whose recent campaigns show repeated overlaps with commercial malware, malware-as-a-service platforms, and affiliate-style ransomware activity.

Historically, Iranian threat actors often tried to disguise state operations as ordinary cyber crime, particularly by posing as ransomware operators or hacktivist collectives.

Today, this behavior goes beyond imitation: some actors appear to be directly consuming criminal tooling and participating in the same ecosystems as financially motivated groups.

 According to CISA, MuddyWater is a subordinate element within MOIS and has carried out broad campaigns in support of Iranian intelligence objectives, targeting government and private-sector organizations across sectors including telecommunications, defense, and energy.

This evolution matters because it improves both deniability and capability, enabling them to scale operations faster while making attribution significantly harder for defenders and governments.

Void Manticore, Handala, and Rhadamanthys

Void Manticore, a MOIS-linked threat actor behind multiple hack-and-leak personas, has used “hacktivist” brands such as Homeland Justice against Albania and Handala in campaigns targeting Israel.

While traditionally associated with wiper attacks and data leaks, recent research shows the Handala persona deploying the commercial Rhadamanthys infostealer, a malware strain sold on darknet forums and used by a wide range of criminal and state actors.

Rhadamanthys has gained traction due to its complex architecture, active development, and service-based sales model, which make it attractive across the cyber crime ecosystem.

In several Handala campaigns, Void Manticore operators paired Rhadamanthys with custom wipers in phishing emails that impersonated Israeli entities and F5 product updates, blending high-end espionage and sabotage with off-the-shelf criminal tooling.

MuddyWater, which U.S. authorities publicly attribute to Iran’s MOIS, has long conducted espionage and disruptive activity across government and critical sectors in the Middle East and beyond.

This illustrates how a state-aligned group can quickly enhance collection and disruption capabilities simply by buying into mature criminal malware-as-a-service offerings.

Recent investigations have tied MuddyWater to the Tsundere botnet, a Node.js- and JavaScript-based platform capable of executing code on compromised systems and dynamically switching to the Deno runtime when needed.

Researchers have labeled this Deno-based variant “DinDoor,” and multiple independent data points, including VPS usage and vendor telemetry, link Tsundere/DinDoor activity back to known MuddyWater infrastructure.

Additional overlaps point to a downloader known as FakeSet, used in infection chains that deliver CastleLoader, a malware-as-a-service framework rented by multiple affiliates.

The connection between MuddyWater and CastleLoader appears to center on shared code-signing certificates, with the same certificate common names seen across MuddyWater malware (“StageComp”), DinDoor samples, and CastleLoader-related FakeSet binaries.

This likely indicates a shared criminal supplier or marketplace rather than formal affiliate status, but it nonetheless demonstrates how MOIS-linked actors and purely criminal clusters can operate from a common tool and certificate pool, complicating cluster separation and attribution.

Iranian Qilin Affiliates

The October 2025 attack on Israel’s Shamir Medical Center further highlights this convergence of state and criminal ecosystems.

Initially framed as a Qilin ransomware incident, the intrusion involved data theft, extortion demands, and subsequent leaks of limited email and medical information, although hospital operations reportedly remained largely unaffected.

Israeli assessments later pointed toward Iranian-linked operators as the real drivers behind the attack, indicating that Qilin’s ransomware-as-a-service infrastructure may have been used by Iran-aligned affiliates to advance strategic objectives under a criminal brand.

Qilin operates on a classic RaaS model, providing tooling and infrastructure to partners who execute intrusions, and this case appears to form part of a broader MOIS and Hezbollah campaign against Israeli hospitals dating back to late 2023.

By working through an established ransomware franchise, Iranian actors gain more than just plausible deniability: they benefit from hardened infrastructure, tested extortion playbooks, and an ecosystem already optimized to pressure victims, even as security around Israeli healthcare has tightened.

Across these cases, the pattern is clear: for MOIS-linked actors such as Void Manticore and MuddyWater, cyber crime has evolved from a cosmetic cover into a practical operational resource.

Direct engagement with the criminal ecosystem via commercial infostealers, shared botnets, MaaS platforms, and RaaS affiliate programs expands their reach, accelerates capability development, and injects noise into attribution efforts.

For defenders, this convergence means that traditional distinctions between “state” and “criminal” threats are increasingly blurred, and overlaps in infrastructure or tooling can no longer be treated as straightforward attribution signals.

Analysts must scrutinize tradecraft, intent, and longer-term patterns rather than relying solely on shared malware families or certificates, even as states like Iran continue to exploit the gray space where espionage and cyber crime meet.

Indicators of Compromise

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.