Skip to content
Auto-CTI
Back to all actors

Iranian state-backed ransomware actors

Unknown Dormant
Mentions
1
First seen
03 Jun 2026
Last seen
03 Jun 2026

Relevant to you · Relevant

Threat focus:
ransomware

Origin

Unattributed

Profile

Iranian state-backed ransomware actors use the Nobitex crypto exchange for their operations. The U.S. has imposed sanctions on Nobitex to disrupt these activities.

Activity (8 weeks)

22
23
24
25
26
27
28
29

Recent activity

ESC