Cyber Threat Actor: Mujahedin-e Khalq (MEK)

The threat actor known as Mujahedin‑e Khalq (MEK) also operates under the aliases National Council of Resistance of Iran (NCRI), National Liberation Army (NLA) and People’s Mujahedin of Iran (MEK). It is described as an exiled Iranian opposition group that is outlawed within Iran and maintains a presence abroad. Public sources locate the actor’s operational focus within Iran, particularly targeting governmental entities in the capital. The group presents itself as a resistance movement seeking to challenge the Iranian regime through various means, including cyber operations.

In the reported incidents the actor directed its efforts against Tehran’s municipal infrastructure, compromising the city’s website, internal computer systems and a large network of surveillance cameras. The attackers defaced online portals with images of MEK leaders and anti‑regime slogans, broadcast similar messages via SMS to hundreds of thousands of residents and seized control of more than five thousand cameras, including those positioned near sensitive sites such as the supreme leader’s office and the tomb of Ruhollah Khomeini. These actions resulted in temporary disruptions of municipal services, including the main website and a citizen‑facing application, while internal networks were rendered inaccessible for short periods. No explicit mention of financial gain or espionage motives appears in the sources; the described objectives center on disruption, propaganda and symbolic opposition to the state.

The actor has claimed responsibility for the June 2022 Tehran municipality attack and previously asserted involvement in a major hack against state‑run television channels in January of the same year, framing both as part of a series of offensive measures against regime agencies. Attribution in the public record rests on the group’s own statements; no state sponsorship or criminal consortium linkage is explicitly documented. The actor’s public posture aligns with an opposition organization conducting cyber‑enabled protest activities rather than a state‑backed or financially motivated entity.