Iranian IRGC Cyber Operations: Disruption & Influence
Iran's IRGC and Ministry of Intelligence run disruptive, influence, and espionage campaigns concentrated on regional rivals and Western adversaries — increasingly aggressive since 2020.
Last updated October 16, 2026
Overview
Iran operates two parallel cyber hierarchies: the Islamic Revolutionary Guard Corps (IRGC), whose units are tracked as APT33/Elfin, APT34/OilRig, and others, and the Ministry of Intelligence and Security (MOIS). Iranian operations blend espionage, destructive wipers (notably against Saudi and Israeli targets), and increasingly sophisticated influence and disinformation campaigns.
Where Chinese operations are patient and Russian ones destructive, Iranian campaigns are opportunistic and adaptive, often rapidly repurposing publicly disclosed vulnerabilities (e.g., Log4Shell, ProxyShell) at scale. Targets skew toward Gulf-state rivals, Israel, and Western critical and government sectors. The 2022–2023 wave of Iranian destructive attacks against Israeli and Albanian targets marked an escalation in operational tempo.
Iranian influence operations — coordinated inauthentic behaviour across social platforms targeting Israeli, Gulf, and Western audiences — have become a distinct strategic capability, often run in parallel with cyber-espionage. Attribution by Meta, Microsoft, and Five Eyes agencies has repeatedly exposed these networks.
Key Points
The IRGC and MOIS run parallel cyber programmes with overlapping targets but distinct objectives and tradecraft.
Iranian groups rapidly weaponise newly-disclosed N-day vulnerabilities at scale, valuing speed over novel zero-day development.
Israel, Saudi Arabia, the UAE, and Gulf-state infrastructure are primary targets, alongside Western government and critical sectors.
Destructive malware against Saudi and Israeli/Albanian targets reflects Iran's willingness to cause impact, not just espionage.
Coordinated inauthentic behaviour campaigns run alongside cyber operations, blending technical and narrative attack vectors.
Latest Intelligence
Global Coalition Disrupts Flax Typhoon Infrastructure Used for State-Sponsored Espionage
Russian Hybrid Sabotage Escalates Against Danish Defense Infrastructure
Global Surge in State-Sponsored Sabotage: Russia and China Escalate Cyber Operations in October 2026
US Disrupts Major Chinese State-Sponsored Hacking Platform Targeting Critical Infrastructure
Escalating Cyber Warfare: Iranian-Linked Cyber Avengers Intensify Operations Against Regional Infrastructure
China-Nexus APTs Accelerate Autonomous Cyber-Espionage Operations Across Asia
Frequently Asked Questions
Encrygma produces defensive intelligence only. This analysis is derived from public reporting, government advisories, and OSINT — no exploit code or attack instructions.
Sovereign Defense SolutionsGet the Weekly Cyberwarfare Briefing
State cyber operations, AI-powered attack campaigns, and offensive cyber industry developments — delivered to your inbox every week.