Mujahedin-e Khalq (MEK)
Attribution profile
- Type
- Activist
- Location
- Iran
- Known incidents
- 2 incidents
- Sources
- 1 source
- First seen
- 2022-06-02
- Last seen
- 2022-06-03
- Updated
- 2026-10-11 01:10
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The Mujahedin-e Khalq (MEK), also referenced as the National Council of Resistance of Iran (NCRI), is an exiled Iranian opposition group that has claimed responsibility for cyber operations against Iranian governmental targets. The group’s known activity focuses on disrupting Iranian state infrastructure within Iran, particularly municipal services and surveillance systems, with the stated aim of undermining regime authority and spreading anti‑regime messaging. In June 2022 MEK asserted that its operatives inside Iran compromised Tehran’s municipality website, defaced it with images of MEK leaders and slogans against the supreme leader, sent similar messages via SMS to hundreds of thousands of residents, and took control of more than 5,000 surveillance cameras across the capital, including those near sensitive sites. Earlier in January 2022 the group claimed a major hack against state‑run television channels. The described tactics involve website defacement, SMS broadcasting, and hijacking of CCTV feeds; no specific malware families or initial‑access vectors are detailed in the sources. MEK presents itself as a resistance movement rather than a state‑sponsored or criminal entity, and no public attribution links it to a foreign intelligence service or criminal consortium.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 1 source.