Article
APT Groups in the MENA Region: Key Threat Actors in Cyber Espionage
Overview of APT groups active in the Middle East and North Africa, including MuddyWater, OilRig and SideWinder, their espionage aims and targets.
Read more
Significant cyber incident
Emennet Pasargad hack-and-leak and information operations against Israel, 2020 to 2024
Emennet Pasargad is an Iranian group that the FBI says has run hack-and-leak and information operations, mainly against Israel, since at least 2020.
In short
Emennet Pasargad is an Iranian group that the FBI says has run hack-and-leak and information operations, mainly against Israel, since at least 2020. Four campaigns between May 2020 and April 2022 hit Israeli sectors under false-flag personas. After the 7 October 2023 Hamas attack it turned to harassing hostage families and accessing IP cameras. The FBI, US Treasury and the Israel National Cyber Directorate warned about it in 2022 and 2024.
What happened
In October 2022 the FBI said the Iranian group Emennet Pasargad had targeted entities mainly in Israel since at least 2020. Its operations followed one pattern: an intrusion, theft and leak of data, then amplification on social media, its own leak sites, Telegram and hacking forums. To avoid attribution the group posed as hacktivists or criminals. Between May 2020 and April 2022 it ran four campaigns against Israeli sectors under the persona Hackers of Savior, most of them around Qods Day. In 2021 it used a criminal persona, Deus, to encrypt and leak data from an Israeli call service center.
After the 7 October 2023 Hamas attack, the October 2024 joint advisory says the group used personas such as Cyber Flood and Contact-HSTG. In Contact-HSTG it tried to contact family members of Israeli hostages. It also scanned for IP cameras, mainly in Israel, within hours of the attack and made camera content available to clients. It searched for information on Israeli fighter pilots and UAV operators. In December 2023 it ran an influence operation through unauthorized access to a US streaming company, using an AI-generated news anchor.
In July 2024 the group compromised a French commercial dynamic display provider and tried to show photo montages that denounced Israeli athletes taking part in the Olympic and Paralympic Games. The same effort included a fake news article and threat messages to Israeli athletes sent under a fake French far-right group name.
Timeline
-
February 2019
US Treasury designates the company under a former name.
-
20 October 2021
A US grand jury indicts two employees over the 2020 US election campaign.
-
18 November 2021
US Treasury designates Emennet Pasargad over that campaign.
-
May 2020
The first of four campaigns under the Hackers of Savior persona begins against Israeli sectors.
-
2021
Under the Deus persona, the group runs a lock-and-leak operation against an Israeli call service center.
-
April 2022
The fourth campaign blends hacking with psychological operations.
-
20 October 2022
The FBI publishes a private industry notification on the hack-and-leak operations.
-
Approximately April 2023
The group starts using a cover hosting provider it set up itself.
-
7 October 2023
After the Hamas attack, the group begins scanning for IP cameras within hours and tries to find data on Israeli pilots.
-
October 2023
Camera content from Israel is made available to clients through several servers; the Cyber Flood persona appears.
-
December 2023
An influence operation uses access to a US streaming company, with an AI-generated news anchor.
-
April 2024
The Cyber Court persona starts promoting purported hacktivist groups run by the group itself.
-
May 2024
The group moves from one cover hosting provider to another.
-
July 2024
A French commercial display provider is compromised; threats go to Israeli athletes.
-
27 September 2024
US Treasury designates six employees and executives of the company.
-
30 October 2024
The FBI, US Treasury and Israel National Cyber Directorate publish a joint advisory.
How the attack worked
Choosing and researching targets
The FBI says the group chose victims by researching leading businesses across several sectors, and was more opportunistic than targeted. It preferred websites running PHP or with externally reachable databases. For people, it used public sources: social media, Instagram location data and a public map service. After 7 October 2023 it searched platforms such as Pastebin and LinkedIn for information on Israeli pilots and UAV operators.
Getting in
The 2022 notice says the actors used open source testing tools such as SQLmap and Acunetix against websites. The 2024 advisory adds scanning and web testing tools and maps SQL injection to Exploit Public-Facing Application (T1190). It also lists automated password guessing (T1110.001). The advisory says the group may seek many compromises at low effort by targeting hosting providers or a content management system common in one sector.
Remote access and infrastructure
The advisory describes an altered browser installer package that ran a hidden executable after the install. The executable is a heavily obfuscated remote access trojan (Remote Access Software, T1219) that contacts a web server for instructions. Since mid-2023 the group used cover hosting providers it set up itself, which the FBI says gave plausible deniability.
Leak, amplify and frighten
The stolen or claimed data was promoted on leak sites, Telegram, hacking forums, news media contacts and email marketing. The FBI judges the campaigns mixed real intrusions with exaggerated or fictitious claims. After October 2023 the same methods served harassment, such as messages to hostage families, camera feeds and threats to athletes.
- ResearchScan sites and look up people in public dataTechnique T1595.002 (MITRE ATT&CK, opens in a new tab)
- Break inSQL injection or password guessingTechnique T1190 (MITRE ATT&CK, opens in a new tab)
- Remote accessAltered installer gives controlTechnique T1219 (MITRE ATT&CK, opens in a new tab)
- StealTake site content or data
- LeakPost under a false-flag persona
- AmplifyTelegram, forums, press and email spread the claim
ATT&CK techniques
Who says who was behind it
Attributed by the FBI, 20 October 2022: the hack-and-leak operations against organizations primarily in Israel are the work of the Iranian group Emennet Pasargad, and the personas Hackers of Savior and Deus are attributed to it.
Attributed by the FBI, US Treasury and the Israel National Cyber Directorate, 30 October 2024: the group has been operating under the company name Aria Sepehr Ayandehsazan (ASA), and the 2023 and 2024 operations described are its work. The FBI obtained information in mid-2024 that ASA was used as a nominal cover.
US Treasury, 18 November 2021: designated Emennet Pasargad over the 2020 US election campaign. That is a separate matter from the Israel operations.
No hub group profile exists yet, so no group link is set. The advisory also lists names used by the private sector; they are not repeated here.
Impact
The FBI says the hack-and-leak campaigns affected victims through financial losses and reputational damage (FBI, 20 October 2022).
The Deus operation encrypted the computers of an Israeli call service center and leaked its data (FBI, 20 October 2022).
The Contact-HSTG operation aimed to cause psychological effects on family members of Israeli hostages (FBI, Treasury and INCD, 30 October 2024).
Camera content from Israel was made available to the group's clients from October 2023.
In July 2024 a French display provider was compromised and threat messages reached several Israeli athletes and their entourage. The sources opened do not say whether the montages were shown.
The sources opened give no counts of victims, money lost or records leaked.
Government and regulator response
- 20 October 2022: the FBI published a private industry notification with mitigation advice and asked victims to contact their local FBI office.
- 20 October 2021: a US grand jury indicted two employees over the 2020 election campaign (FBI notice of 26 January 2022).
- 27 September 2024: US Treasury designated six more employees and executives.
- 18 November 2021: US Treasury designated the company over the 2020 election campaign; the State Department’s Rewards for Justice offers up to $10 million for information on foreign election interference involving it.
- 30 October 2024: the FBI, US Treasury and Israel National Cyber Directorate published a joint advisory with techniques, indicators and mitigations.
- The advisory says one domain used by the group was seized under a warrant from a US federal court in a joint law enforcement operation.
Lessons
-
Claims are part of the weapon
The FBI says the group mixed real intrusions with exaggerated or fictitious claims. Check what is true before you respond in public.
-
Ordinary web flaws were enough
The group relied on SQL injection and password guessing against public sites. Basic web hygiene removes a large share of this risk.
-
Personas hide one actor
One company ran many names: hacktivists, criminals and a news-style brand. Group incidents by technique and infrastructure, not by name.
-
Public data helps stalkers
The group searched social platforms and image services to find pilots and families. Staff and families in sensitive roles need guidance on what they share.
-
Cameras and displays are targets
IP cameras and a commercial display provider were used for effect. Treat such devices as exposed internet systems.
-
Events attract these groups
The 2024 Games and the 7 October attack both drew operations within weeks. Plan for them before major events.
What to check in your own organization
-
Public web apps
Test every public site for SQL injection and keep content management systems patched; the FBI names Drupal and WordPress.
-
Login attempts
Alert on automated password guessing and limit login attempts on admin pages.
-
IP cameras
Find every camera reachable from the internet and remove default access; the group scanned port 554.
-
Content integrity
Keep a known-good copy of web content and use file integrity monitoring to spot edits.
-
Installer files
Only install browser and software updates from official sources; the group altered an installer package.
-
Leak response
Prepare a plan for a claimed leak: verify, notify, and brief spokespeople.
-
Staff exposure
Review what pilots, security staff and families post publicly; the group searched for exactly this.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country Israel Israel is a small, highly connected country that faces frequent cyber activity linked to the region's conflicts. Middle East
Questions
Who is Emennet Pasargad?
An Iranian group. The FBI, US Treasury and the Israel National Cyber Directorate say it has operated under the company name Aria Sepehr Ayandehsazan.
What is hack-and-leak?
Stealing data and then publishing it, often with loud claims, to embarrass the victim and shake public trust.
Were the claims always true?
Not always. The FBI judges that the group mixed real intrusions with exaggerated or fictitious claims of access or stolen data.
What did the group do after 7 October 2023?
The advisory lists messages to hostage families, access to Israeli IP cameras, searches for information on Israeli pilots, and operations around the 2024 Olympics.
Did it attack the Paris Olympics?
The advisory says it compromised a French display provider in July 2024 to show montages against Israeli athletes and sent threats to athletes. It does not describe the Games themselves being disrupted.
Is the group sanctioned?
US Treasury designated it on 18 November 2021 over the 2020 US election campaign.
In our research
Sources
- Iranian Cyber Group Emennet Pasargad Conducting Hack-and-Leak Operations Using False-Flag Personas (PIN 20221020-001) FBI (IC3)
- New Tradecraft of Iranian Cyber Group Aria Sepehr Ayandehsazan aka Emennet Pasargad (AA24-233A) FBI, US Treasury, Israel National Cyber Directorate
- Treasury Sanctions Iran Cyber Actors for Attempting to Influence the 2020 U.S. Presidential Election US Department of the Treasury
- Rewards for Justice: Emennet Pasargad US Department of State
- Context and Recommendations to Protect Against Malicious Activity by Iranian Cyber Group Emennet Pasargad (PIN-20220126-001) FBI (IC3)
- Treasury Sanctions Iranian Regime Agents Attempting to Interfere in U.S. Elections US Department of the Treasury
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.