--- title: Iran MOIS Colludes With Criminals to Boost Cyberattacks description: Iran's Ministry of Intelligence and Security (MOIS) has moved beyond merely impersonating cybercriminal groups and is now actively collaborating with real... canonical: https://daily.dev/posts/iran-mois-colludes-with-criminals-to-boost-cyberattacks-rvbj1pdsp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Iran MOIS Colludes With Criminals to Boost Cyberattacks | daily.dev og:description: Iran's Ministry of Intelligence and Security (MOIS) has moved beyond merely impersonating cybercriminal groups and is now actively collaborating with real... og:url: https://daily.dev/posts/iran-mois-colludes-with-criminals-to-boost-cyberattacks-rvbj1pdsp og:image: https://api.daily.dev/og/posts/RvbJ1pdSp.png og:image:alt: Iran MOIS Colludes With Criminals to Boost Cyberattacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Iran MOIS Colludes With Criminals to Boost Cyberattacks **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Iran's Ministry of Intelligence and Security (MOIS) has moved beyond merely impersonating cybercriminal groups and is now actively collaborating with real criminal operations. According to Check Point research, MOIS-linked APTs like Void Manticore have integrated commercial infostealers such as Rhadamanthys into their attack chains, while other MOIS entities have partnered with ransomware-as-a-service operations. A notable example includes a 2025 Israeli hospital attack initially attributed to the Qilin ransomware group that was later linked to Iran. This blending of state and criminal activity complicates attribution, allowing Iranian actors to disguise destructive attacks as ordinary cybercrime. Security teams risk misclassifying Iranian APT activity as low-priority cybercrime incidents. The trend is driven by wartime resource pressure and the convenience of purchasing access, tooling, and infrastructure from criminal markets rather than developing them in-house. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Cybercrime isn't just a cover for Iran's government goons](https://daily.dev/posts/cybercrime-isn-t-just-a-cover-for-iran-s-government-goons-mx17rxkm9) · The Register · 1 upvotes · 0 comments - [Defending Against Iranian Cyber Threats in the Wake of Operation Epic Fury](https://daily.dev/posts/defending-against-iranian-cyber-threats-in-the-wake-of-operation-epic-fury-n4sthyjvr) · Security Boulevard · 0 upvotes · 0 comments - [The thin gray line: Handala, CyberAv3ngers and Iran’s proxy ops](https://daily.dev/posts/the-thin-gray-line-handala-cyberav3ngers-and-iran-s-proxy-ops-pcjlkse4z) · CSO Online · 0 upvotes · 0 comments - [Iran Has One Card Left—It’s Pointed at Your Network](https://daily.dev/posts/iran-has-one-card-left-it-s-pointed-at-your-network-addufvvtx) · Security Boulevard · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/iran-mois-colludes-with-criminals-to-boost-cyberattacks-rvbj1pdsp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Iran MOIS Colludes With Criminals to Boost Cyberattacks","url":"https://daily.dev/posts/iran-mois-colludes-with-criminals-to-boost-cyberattacks-rvbj1pdsp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/iran-mois-colludes-with-criminals-to-boost-cyberattacks-rvbj1pdsp"},"datePublished":"2026-03-12T21:37:17.842Z","dateModified":"2026-03-12T21:37:47.440Z","description":"Iran's Ministry of Intelligence and Security (MOIS) has moved beyond merely impersonating cybercriminal groups and is now actively collaborating with real...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/12aa5f23afeb86a567553d8aef6be65e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/12aa5f23afeb86a567553d8aef6be65e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/iran-mois-colludes-with-criminals-to-boost-cyberattacks-rvbj1pdsp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Iran MOIS Colludes With Criminals to Boost Cyberattacks"}]} ```