{
	"id": "208bb4e6-edcd-4ba8-9074-36985c180de1",
	"created_at": "2026-04-06T00:08:13.15919Z",
	"updated_at": "2026-04-10T03:25:32.291485Z",
	"deleted_at": null,
	"sha1_hash": "08f87cc77b81c5cc10e0190690f8b1706c983303",
	"title": "KromSec Against Iran, Sells Ministry Database On Dark Web",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 849495,
	"plain_text": "KromSec Against Iran, Sells Ministry Database On Dark Web\r\nPublished: 2023-01-25 · Archived: 2026-04-02 11:56:38 UTC\r\nA user under the name of the infamous hacking group KromSec has put the database of the Iran Ministry of\r\nIndustries and Mines on a hacker forum.\r\nKromSec has been in the cybersecurity news for cyber-attacks on the Iran government. They have openly\r\nexpressed their support for the people of Iran fighting against the ruling Islamic government.\r\nThe attack comes months after the death of 22-year-old Iranian woman Mahsa Amini, who died under suspicious\r\ncircumstances three days after her arrest in Tehran by Iran’s morality police.\r\nAmini’s death sparked a big uprising against Iran, and hacker groups began supporting the Iranian citizens.\r\nIndependent Iranian media outlets reported that Amini lost her life due to repeated beatings, but Iran continued to\r\nrefute the claims and argued that her death was due to an illness.\r\nThe three-week protest in Iran soon became an international issue, with several knowns personalities and\r\ncelebrities joining the movement.\r\nhttps://thecyberexpress.com/kromsec-sells-iran-ministry-database-dark-web/\r\nPage 1 of 3\n\nCredit FalconFeedsio\r\nSeveral threat actors have already been a threat to Iran’s government, and a spike in cyber-attack has been noted\r\nafter Amini’s death.\r\nKromSec Attacks Iran\r\nKromsec, in collaboration with the notorious hacker collective Spid3r, has launched several cyber warfare\r\noffensive campaigns against Iran. The attacks are attributed to being a part of Anonymous’ #OpIran.\r\nThese attacks have caused significant problems for Tehran, targeting government websites, pro-government\r\nmedia, government officials, and institutions such as the central bank and various ministries.\r\nIn the latest attack, KromSec set up the Ministry of Industries and Mines of Iran as a saleable item on a popular\r\nhacker forum.\r\nAccording to the post shared by  KromSec on the forum, they currently have personal information stolen from the\r\nMinistry webserver.\r\n“Today we have publicly announce the Database of the Ministry of Industries, and Mines of Iran for sale in the\r\nbreached forum,” read the post by KromSec. The stolen data is being sold as an SQL file with 2,552,222 lines.\r\nIn a similar incident, on January 10, 2023, a member of the KromSec threat group posted a sensitive database\r\nbelonging to Iran’s National Standards Organization on a dark web forum.\r\nThe information included in this database was highly confidential, containing details of government officials and\r\nother sensitive data.\r\nhttps://thecyberexpress.com/kromsec-sells-iran-ministry-database-dark-web/\r\nPage 2 of 3\n\nSource: https://thecyberexpress.com/kromsec-sells-iran-ministry-database-dark-web/\r\nhttps://thecyberexpress.com/kromsec-sells-iran-ministry-database-dark-web/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"references": [
		"https://thecyberexpress.com/kromsec-sells-iran-ministry-database-dark-web/"
	],
	"report_names": [
		"kromsec-sells-iran-ministry-database-dark-web"
	],
	"threat_actors": [
		{
			"id": "763f2092-2b32-4579-baf0-ada8c8bc7b43",
			"created_at": "2023-11-08T02:00:07.117517Z",
			"updated_at": "2026-04-10T02:00:03.418144Z",
			"deleted_at": null,
			"main_name": "KromSec",
			"aliases": [],
			"source_name": "MISPGALAXY:KromSec",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434093,
	"ts_updated_at": 1775791532,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/08f87cc77b81c5cc10e0190690f8b1706c983303.pdf",
		"text": "https://archive.orkl.eu/08f87cc77b81c5cc10e0190690f8b1706c983303.txt",
		"img": "https://archive.orkl.eu/08f87cc77b81c5cc10e0190690f8b1706c983303.jpg"
	}
}