Cybercrime isn't just a cover for Iran's government goons - it's a key part of their operations
(2026/03/10)
- Reference: 1773167147
- News link: https://www.theregister.co.uk/2026/03/10/cybercrime_iran_mois/
- Source link:
Iranian government-backed snoops are increasingly using cybercrime malware and ransomware infrastructure in their operations - not just hiding behind criminal masks as a cover for destructive cyber activity, according to security researchers.
Ministry of Intelligence and Security (MOIS)-linked operatives appear to be the biggest offenders, according to Check Point Research, [1]citing "repeated overlaps" between [2]MuddyWater (aka Seedworm, Static Kitten) and Void Manticore (aka Storm-842, Handala Hack), and various criminal organizations and their tools and services. Both MuddyWater and Void Manticore are affiliated with the Iranian intelligence agency.
[3]Void Manticore is a hacktivist crew that uses wipers, data leaks, and disinformation to advance Iranian government objectives, usually in campaigns targeting Israel. It also recently added a commercial infostealer - Rhadamanthys - sold on cybercrime forums to its arsenal, according to Check Point.
[4]
As The Reg readers likely remember, international cops disrupted Rhadamanthys operators' infrastructure in November, [5]seizing 1,025 servers tied to the malware during a series of raids. But as is usually the case with malware operators and movie monsters, this was more of a setback than an outright kill.
[6]
[7]
Handala Hack, one of Void Manticore's hacktivist personas, has used Rhadamanthys "on several occasions," according to the Tel Aviv-based security researchers. The Iranian cyberspies typically pair the commercial infostealer with one of their custom data wipers in phishing emails sent to Israeli targets, frequently impersonating F5 updates, we're told. In the Tuesday research, Check Point shows one of these phishes that impersonated the Israeli National Cyber Directorate (INCD).
MuddyWater dips into malware-as-a-service
MuddyWater, on the other hand, has conducted espionage operations on behalf of the MOIS since about 2018, most recently [8]burrowing into critical American networks following the [9]US and Israeli airstrikes against Iran. In these intrusions, the group used a previously unseen backdoor called DinDoor, which is a new variant of the [10]MuddyWater-linked Tsundere botnet , according to Check Point.
Another malware family linked to MuddyWater is a downloader called FakeSet, which the security researchers say was used in recent infections to deliver CastleLoader. [11]CastleLoader is sold as a service to multiple affiliates and cyber crews. According to Check Point, the link between CastleLoader and MuddyWater stems from the use of a set of code-signing certificates, specifically under the Common Names Amy Cherne and Donald Gay - also spotted in the DinDoor campaign.
These reports linking MuddyWater's operations to several different crime clusters benefit the government-backed group, the Tel Aviv security shop said.
[12]Iran intelligence backdoored US bank, airport, software outfit networks
[13]Iran's cyberwar has begun
[14]Ransomware isn't always about the money: Government spies have objectives, too
[15]Hacktivism resurges – but don't be fooled, it's often state-backed goons in masks
"The use of such tools has created significant confusion, leading to misattribution and flawed pivoting, and clustering together activities that are not necessarily related," Check Point Research wrote. "This demonstrates that the use of criminal software can be effective for obfuscation, and highlights the need for extreme caution when analyzing overlapping clusters."
Finally, while Iran's goon squads have a history of [16]working with ransomware gangs , and we saw state-sponsored [17]ransomware attempts reemerge during the summer 2025 conflict, offering big bucks for infections against US and Israeli orgs, more [18]recent reports have linked Iranian operatives to an October 2025 ransomware attack against the Israeli Shamir Medical Center. This infection initially appeared to have been carried out by a Qilin affiliate.
[19]
"The emerging picture was that the attackers were likely Iranian-affiliated operators working through the cyber criminal ecosystem, using a criminal ransomware brand and methods associated with the broader extortion market, while serving a strategic Iranian objective," Check Point said, adding that this ransomware infection is part of a larger campaign by MOIS and Hezbollah to target Israeli hospitals. ®
Get our [20]Tech Resources
[1] https://research.checkpoint.com/2026/interplay-between-iranian-targeting-of-ip-cameras-and-physical-warfare-in-the-middle-east/
[2] https://www.theregister.com/2025/11/19/amazon_cso_warfare_cyber_kinetic/
[3] https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2abCik3ln-y_Zz6JXY_9OVgAAAEk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2025/11/13/rhadamanthys_takedown/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44abCik3ln-y_Zz6JXY_9OVgAAAEk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33abCik3ln-y_Zz6JXY_9OVgAAAEk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2026/03/05/mudywater_backdoor_us_networks/
[9] https://www.theregister.com/2026/03/02/cyber_warfighters_iran/
[10] https://ctrlaltintel.com/threat%20research/MuddyWater/#python-server
[11] https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries
[12] https://www.theregister.com/2026/03/05/mudywater_backdoor_us_networks/
[13] https://www.theregister.com/2026/03/02/cyber_warfighters_iran/
[14] https://www.theregister.com/2025/02/12/ransomware_nation_state_groups/
[15] https://www.theregister.com/2025/04/13/hacktivism_is_having_a_resurgence/
[16] https://www.theregister.com/2024/08/28/iran_pioneer_kitten/
[17] https://www.theregister.com/2025/07/09/iranian_ransomware_crew_reemerges/
[18] https://www.ynet.co.il/health/article/s11j7murxg#google_vignette
[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44abCik3ln-y_Zz6JXY_9OVgAAAEk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[20] https://whitepapers.theregister.com/
Ministry of Intelligence and Security (MOIS)-linked operatives appear to be the biggest offenders, according to Check Point Research, [1]citing "repeated overlaps" between [2]MuddyWater (aka Seedworm, Static Kitten) and Void Manticore (aka Storm-842, Handala Hack), and various criminal organizations and their tools and services. Both MuddyWater and Void Manticore are affiliated with the Iranian intelligence agency.
[3]Void Manticore is a hacktivist crew that uses wipers, data leaks, and disinformation to advance Iranian government objectives, usually in campaigns targeting Israel. It also recently added a commercial infostealer - Rhadamanthys - sold on cybercrime forums to its arsenal, according to Check Point.
[4]
As The Reg readers likely remember, international cops disrupted Rhadamanthys operators' infrastructure in November, [5]seizing 1,025 servers tied to the malware during a series of raids. But as is usually the case with malware operators and movie monsters, this was more of a setback than an outright kill.
[6]
[7]
Handala Hack, one of Void Manticore's hacktivist personas, has used Rhadamanthys "on several occasions," according to the Tel Aviv-based security researchers. The Iranian cyberspies typically pair the commercial infostealer with one of their custom data wipers in phishing emails sent to Israeli targets, frequently impersonating F5 updates, we're told. In the Tuesday research, Check Point shows one of these phishes that impersonated the Israeli National Cyber Directorate (INCD).
MuddyWater dips into malware-as-a-service
MuddyWater, on the other hand, has conducted espionage operations on behalf of the MOIS since about 2018, most recently [8]burrowing into critical American networks following the [9]US and Israeli airstrikes against Iran. In these intrusions, the group used a previously unseen backdoor called DinDoor, which is a new variant of the [10]MuddyWater-linked Tsundere botnet , according to Check Point.
Another malware family linked to MuddyWater is a downloader called FakeSet, which the security researchers say was used in recent infections to deliver CastleLoader. [11]CastleLoader is sold as a service to multiple affiliates and cyber crews. According to Check Point, the link between CastleLoader and MuddyWater stems from the use of a set of code-signing certificates, specifically under the Common Names Amy Cherne and Donald Gay - also spotted in the DinDoor campaign.
These reports linking MuddyWater's operations to several different crime clusters benefit the government-backed group, the Tel Aviv security shop said.
[12]Iran intelligence backdoored US bank, airport, software outfit networks
[13]Iran's cyberwar has begun
[14]Ransomware isn't always about the money: Government spies have objectives, too
[15]Hacktivism resurges – but don't be fooled, it's often state-backed goons in masks
"The use of such tools has created significant confusion, leading to misattribution and flawed pivoting, and clustering together activities that are not necessarily related," Check Point Research wrote. "This demonstrates that the use of criminal software can be effective for obfuscation, and highlights the need for extreme caution when analyzing overlapping clusters."
Finally, while Iran's goon squads have a history of [16]working with ransomware gangs , and we saw state-sponsored [17]ransomware attempts reemerge during the summer 2025 conflict, offering big bucks for infections against US and Israeli orgs, more [18]recent reports have linked Iranian operatives to an October 2025 ransomware attack against the Israeli Shamir Medical Center. This infection initially appeared to have been carried out by a Qilin affiliate.
[19]
"The emerging picture was that the attackers were likely Iranian-affiliated operators working through the cyber criminal ecosystem, using a criminal ransomware brand and methods associated with the broader extortion market, while serving a strategic Iranian objective," Check Point said, adding that this ransomware infection is part of a larger campaign by MOIS and Hezbollah to target Israeli hospitals. ®
Get our [20]Tech Resources
[1] https://research.checkpoint.com/2026/interplay-between-iranian-targeting-of-ip-cameras-and-physical-warfare-in-the-middle-east/
[2] https://www.theregister.com/2025/11/19/amazon_cso_warfare_cyber_kinetic/
[3] https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2abCik3ln-y_Zz6JXY_9OVgAAAEk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2025/11/13/rhadamanthys_takedown/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44abCik3ln-y_Zz6JXY_9OVgAAAEk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33abCik3ln-y_Zz6JXY_9OVgAAAEk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2026/03/05/mudywater_backdoor_us_networks/
[9] https://www.theregister.com/2026/03/02/cyber_warfighters_iran/
[10] https://ctrlaltintel.com/threat%20research/MuddyWater/#python-server
[11] https://www.recordedfuture.com/research/graybravos-castleloader-activity-clusters-target-multiple-industries
[12] https://www.theregister.com/2026/03/05/mudywater_backdoor_us_networks/
[13] https://www.theregister.com/2026/03/02/cyber_warfighters_iran/
[14] https://www.theregister.com/2025/02/12/ransomware_nation_state_groups/
[15] https://www.theregister.com/2025/04/13/hacktivism_is_having_a_resurgence/
[16] https://www.theregister.com/2024/08/28/iran_pioneer_kitten/
[17] https://www.theregister.com/2025/07/09/iranian_ransomware_crew_reemerges/
[18] https://www.ynet.co.il/health/article/s11j7murxg#google_vignette
[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44abCik3ln-y_Zz6JXY_9OVgAAAEk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[20] https://whitepapers.theregister.com/
Re: Taste in goons
Paul Herber
With the destroyed Iranian navy at least they won't be having so much trouble with falling in the water!
Re: Taste in goons
The commentard formerly known as Mister_C
well played Neddie. Help yourself to a picture of a ten bob note.
Ditto US
KRCaddis
I'm sure the US does the same things to our perceived and real enemies. I am surprised my network access even works at....
The Jessica Lyons dictionary
VoiceOfTruth
American spies: red white and blue, apple pie eating heroes
Anyone else: goons.
I would like to see Lyons do a write up on the USAs spying at the United Nations building in New York. I wonder if she would have to clear it with her handler first.
Re: The Jessica Lyons dictionary
Paul Herber
'red white and blue'
Ah yes, our French friends.
Re: 'red white and blue'
MiguelC
Hey! What's your problem with Luxembourgers?
Re: 'red white and blue'
Paul Herber
I'm not married to a Luxembourger!
Re: The Jessica Lyons dictionary
agurney
'red white and blue'
not Russian?
This is a bullshit 'article'
VoiceOfTruth
Where was Lyons when the USA committed piracy against Venezuelan fishermen?
Where was Lyons when the USA illegally invaded Venezuela?
It's the American world view in one 'article': The USA bombs and murders who the hell it likes. Nothing to see here. Anyone else: Goons, terrorists.
Fuck America.
Taste in goons
I prefer Iranian goons to the Israeli and USA varieties.