Rana Institute

The Rana Institute, also known by its alias, is a contractor for the Iranian Ministry of Intelligence and is headquartered in Iran. It operates within the realm of cyber‑espionage, carrying out activities on behalf of the state. Its primary function involves conducting intelligence‑gathering operations through digital means.

The group’s activities, as revealed by a 2019 leak, include targeting airlines and online travel booking platforms to obtain passenger manifests, reservation details, and payment card information. These operations are designed to collect data that can be used for surveillance and tracking. Evidence from the leaked documents indicates a focus on monitoring Iranian citizens both inside the country and abroad.

The leak occurred on May 9 2019 and exposed internal documents that had been compiled since at least 2015. The compromised materials were shared via Telegram channels and various Dark Web portals, containing secret operational strategies, employee information, and victim lists. Independent security researchers verified the authenticity of the leaked files, confirming their connection to the Rana Institute.

These disclosures placed the Rana Institute among several Iranian state‑linked hacking groups that have been exposed in recent years. The leak provided rare insight into the tactics and objectives of such operations, which had previously been undisclosed. It highlighted the organization’s role in a broader pattern of cyber‑espionage conducted by Iranian contractors.

The incident underscored the value of leaked intelligence in revealing the scope and methods of state‑sponsored cyber activities, offering a clearer view of the Rana Institute’s contributions to Iranian intelligence efforts. No further details about its size, organizational structure, or additional activities are available from the verified sources.