NEPTUNIUM
Attribution profile
- Type
- Nation State
- Location
- Iran
- Known incidents
- 1 incident
- Sources
- 10 sources
- First seen
- 2023-01-04
- Last seen
- 2023-01-04
- Updated
- 2026-10-11 02:39
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
NEPTUNIUM, also known as Emennet Pasargad, is an Iranian state‑linked threat actor. It has targeted the media sector, specifically the French satirical magazine Charlie Hebdo, compromising its online store to exfiltrate personal data of over 200,000 subscribers and leaking that information. The actor amplified the breach by operating under the “Holy Souls” persona, creating fabricated French‑language social media accounts that impersonated local authorities and journalists to advertise the stolen data and spread disinformation. Observed tactics include web‑application intrusion, data theft, leak‑and‑publish operations, and the use of false online personas for influence campaigns. Microsoft’s Digital Threat Analysis Center has linked NEPTUNIUM’s activity to broader Iranian influence tactics, including hack‑and‑leak and coordinated disinformation efforts aimed at undermining confidence in the victim’s security. No further details on malware families, tooling, or additional campaigns are provided in the source material.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 10 sources.