Ministry of Intelligence and Security (MOIS)

Reported Context (4)

FBI court documents reportedly state that Iran’s MOIS has used Handala as one of several monikers for hacking campaigns and leak operations; domains seized by the Justice Department were allegedly used by MOIS. DOJ Confirms Breach of FBI Director Kash Patel’s Personal Email
The FBI alert described MOIS as using Telegram-linked malware to infect devices and steal information from or monitor targeted people. FBI Warns of Russian and Iranian Campaigns Targeting Messaging Apps
The FBI and DOJ attributed operations involving the seized domains to Iran’s MOIS, which the article says operated under online monikers including Handala. FBI Seizes Four Domains Linked to Iran’s MOIS and Handala Operations
The article associates cyber operations by Iranian-linked actors with MOIS objectives and describes MuddyWater as a subordinate element within MOIS, citing CISA. Check Point Details MOIS-Linked Actors’ Use of Cybercrime Tools

Malware (6)

People (3)

Threat Actors (5)

MITRE ATT&CK (11)

Vendors (2)

Products (7)

Tools (1)

Industries (5)

Countries (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.