apt

Emennet Pasargad

active · last signal 1y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Cotton SandstormHaywire KittenMarnanbridgeAria Sepehr AyandehsazanASANeptuneYellow Garuda

Attribution

Iran — IRGC-affiliated (assessed linked to the Islamic Revolutionary Guard Corps); U.S. government-attributed and sanctioned

Origin

Iran

First seen

2020

Last active

2026

Motivation

Information operations

Attribution confidence

medium

MENA targeting

Israel, United States

Sectors

Influence operations, hack-and-leak, election interference, media

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel, United States (Influence operations, hack-and-leak, election interference sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Moses StaffactorTechnique overlap
Imperial Kitten (CURIUM)actorTechnique overlap
Void Manticore (Storm-0842)actorTechnique overlap
Fox KittenactorTechnique overlap
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap
Iranian Cyber Actors May Target Vulnerable US Networks and Entities of InterestreportORKL2025-06-27
Microsoft Word - JCSA-20241030-001reportORKL2024-10-30
Iran steps into US election 2024 with cyber-enabled influence operationsreport

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?