Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Iranian MOIS Actors & the Cyber Crime Connection Key Points Iran-linked actors are increasingly engaging with the cyber crime ecosystem. Their activity suggests a growing reliance on criminal tools, services, and operational models in support of state objectives. Iranian actors have long used cyber crime and hacktivism as cover for destructive activity, but the trend now suggests direct engagement with the criminal ecosystem. […] The post Iranian MOIS Actors & the …

https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection

sha256:27eed6ea933cd39a1882815c6bc72fd9cd31fc929c17eda3f8d018db30917174

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md51
url0
ipv41
ipv60
sha110
domain0
sha25614
malware_token0
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
ip	18.223.24.218	Open →
md5	eb5e96e05129e5691f9677be4e396c88	Open →
sha1	0902d7915a19975817ec1ccb0f2f6714aed19638	Open →
sha1	2087bb914327e937ea6e77fe6c832576338c2af8	Open →
sha1	21a435ecaa7b86efbec7f6fb61fcda3da686125c	Open →
sha1	389b12da259a23fa4559eb1d97198120f2a722fe	Open →

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

MuddyWater

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports