Cyber Threat Actor: Iranian intelligence

The threat actor known as Iranian intelligence operates under the alias of Iranian intelligence and is based in Iran. It is a state‑sponsored entity directly affiliated with the Iranian government's intelligence apparatus. Public attribution links the actor to Iran’s intelligence services, establishing a clear state nexus. No criminal consortium or non‑state affiliation is indicated in the available information. This background defines the actor as a nation‑state threat group.

The actor’s observed targeting focuses on political figures and election‑related environments, as demonstrated by the compromise of a senior Israeli politician’s cellphone during an election campaign. The primary sector involved is the political sector. The incident aligned with broader concerns raised by national cybersecurity authorities about foreign state‑sponsored cyber threats targeting electoral processes and, more generally, critical infrastructure. Strategic objectives evident from the incident include espionage through the unauthorized acquisition of personal and professional data. The actor also appears to seek influence over election outcomes by enabling information disclosure or manipulation. These objectives are consistent with warnings about foreign state‑backed cyber threats to democratic processes.

The reported tactics involve the compromise of a cellphone, which granted the actor access to data stored on the device. No specific malware families, exploit kits, or tooling styles are described in the source material. The initial access vector is not detailed beyond the successful breach of the mobile device. The actor’s tooling style appears to be focused on mobile device intrusion rather than broader network‑based campaigns. Consequently, the only confirmed TTP theme is the unauthorized access to a mobile phone to exfiltrate information.

The Benny Gantz cellphone incident serves as a representative example of the actor’s publicly reported operations, highlighting its capability to target high‑profile individuals during politically sensitive periods. The operation underscored the risk of election interference through the potential release or alteration of compromised data. Israeli security officials warned that such breaches could threaten information integrity and influence electoral outcomes. No additional campaigns are detailed in the provided context, limiting the profile to this observed case. The actor’s activities, as currently documented, remain centered on mobile‑device espionage aimed at political targets.