Cyber Threat Actor: MOIS

The threat actor known as MOIS, also referred to as the Ministry of Intelligence and Security, operates from Iran and has been publicly linked to cyber operations targeting Israeli political figures and state infrastructure. According to reporting, the actor compromised the personal cellphone of Benny Gantz, a former Israeli defense chief and political rival, during an election campaign, gaining access to both personal and professional data stored on the device. The intrusion was described by Israeli security officials as a potential threat to the electoral process, with the possibility that Tehran could expose or manipulate information obtained from the phone. Beyond individual targeting, the actor has been associated with broader efforts to disrupt state functions, including attempts to affect electricity supplies, banking systems, and financial institutions, indicating a strategic aim of creating operational instability alongside espionage. These activities align with a stated objective of influencing election outcomes and undermining confidence in national institutions.

Attribution to the MOIS is grounded in the explicit identification of Iranian intelligence as the perpetrator in the Gantz phone hack, establishing a clear state nexus rather than a criminal or mercenary affiliation. The reported tactics involve the compromise of mobile devices, though specific malware families, exploit kits, or initial access vectors are not detailed in the available sources. The actor’s tooling style remains unspecified, with the emphasis placed on the outcome of accessing phone contents rather than the technical means employed. A notable campaign cited in the evidence is the 2019 intrusion into Gantz’s device, which Israeli officials linked to a wider pattern of cyber interference intended to impact the Israeli election and potentially facilitate further assaults on critical state infrastructure. This operation exemplifies the actor’s focus on political espionage and disruption as demonstrated through publicly reported incidents.