Lab Dookhtegan

Profile narrative

Lab Dookhtegan is a threat actor known by the alias Lab Dookhtegan. The group has been observed conducting a single publicly reported operation that targeted an Iranian satellite communications provider to gain access to the country’s state‑owned tanker fleet. This activity establishes Lab Dookhtegan as an actor capable of executing supply‑chain compromises against critical maritime infrastructure.

The actor’s targeting focuses on the maritime and communications sectors within Iran, as evidenced by the compromise of Fanava, an Iranian satellite communications provider, and the subsequent manipulation of ship‑to‑shore VOIP services used by Iranian state‑owned tankers operated by NITC and IRISL. The observed objectives include espionage through the theft and online leakage of internal corporate documents, disruption of communications between vessels and shore‑based facilities, and sabotage by destroying onboard modems via overwriting partitioned memory, which rendered the hardware irrecoverable without physical replacement. These actions demonstrate a combination of information gathering, service interruption, and destructive impact.

The reported tactics involve a supply‑chain attack vector where the group first penetrated the provider’s systems, then leveraged that access to exert fleetwide control over VOIP communications. After exfiltrating sensitive documents, the actors deployed a destructive routine that overwrote the partitioned memory of the ship‑borne modems, a technique consistent with wiper‑style behavior. No specific malware families or tooling names are mentioned in the source material, so the description is limited to the observed phases of intrusion, data theft, service disruption, and hardware destruction.

Public attribution of Lab Dookhtegan to any state sponsor, criminal consortium, or other affiliation has not been established in the available reporting. Consequently, any discussion of alliances or national ties would be speculative and is omitted here. The only definitively linked campaign is the January 1 2025 operation against Fanava and the associated Iranian tanker fleet, which remains the representative example of the group’s activity in open sources. This concludes the factual profile based solely on the provided information.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 0 sources.