{
	"id": "9a9393d6-c364-4a32-a577-feff8fc2a92c",
	"created_at": "2026-04-06T00:10:44.316854Z",
	"updated_at": "2026-04-10T03:31:39.580495Z",
	"deleted_at": null,
	"sha1_hash": "592bd697746fefc8f4a035319a80560cd312f6e0",
	"title": "[Unnamed groups: Iran] - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 81264,
	"plain_text": "[Unnamed groups: Iran] - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-05 21:04:13 UTC\r\nHome \u003e List all groups \u003e [Unnamed groups: Iran]\r\n APT group: [Unnamed groups: Iran]\r\nNames [Unnamed groups: Iran] (?)\r\nCountry Iran\r\nSponsor State-sponsored\r\nMotivation Information theft and espionage\r\nFirst seen 2019\r\nDescription\r\nThese are reported APT activities attributed to a country, but not to an individual\r\nthreat group.\r\nObserved\r\nSectors: Aviation, Government, Industrial, IT, Telecommunications.\r\nCountries: Afghanistan, Australia, Azerbaijan, Bahrain, Colombia, Dubai, Egypt,\r\nEthiopia, Fiji, Hong Kong, India, Indonesia, Iraq, Israel, Kenya, Kuwait,\r\nKyrgyzstan, Lebanon, Malaysia, Mauritius, Morocco, New Zealand, Oman,\r\nPakistan, Philippines, Qatar, South Africa, Sri Lanka, Syria, Thailand, Turkey, UAE,\r\nUSA.\r\nTools used\r\nOperations performed\r\n2017\r\nI Spy With My Little Eye: Uncovering an Iranian\r\nCounterintelligence Operation\r\n\u003chttps://cloud.google.com/blog/topics/threat-intelligence/uncovering-iranian-counterintelligence-operation\u003e\r\nNov 2023\r\nPennsylvania water authority hit with cyberattack allegedly tied to\r\npro-Iran group\r\n\u003chttps://therecord.media/water-authority-pennsylvania-cyberattack-pro-iran-group\u003e\r\nNov 2023\r\nNorth Texas water utility serving 2 million hit with cyberattack\r\n\u003chttps://therecord.media/north-texas-water-utility-cyberattack\u003e\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=01106777-4eb0-4a37-b7d3-c8ca539e2403\r\nPage 1 of 3\n\nDec 2023\nFlorida water agency latest to confirm cyber incident as feds warn of\nnation-state attacks\nCounter operations\nMay 2019\nOn Friday May 5th, dozens of confidential documents labeled as\n“secret” were leaked on Telegram.\nFeb 2024\nTreasury Sanctions Actors Responsible for Malicious Cyber\nActivities on Critical Infrastructure\nApr 2024\nTreasury Designates Iranian Cyber Actors Targeting U.S. Companies\nand Government Agencies\nAug 2024\nDisrupting a covert Iranian influence operation\nSep 2024\nThree IRGC Cyber Actors Indicted for ‘Hack-and-Leak’ Operation\nDesigned to Influence the 2024 U.S. Presidential Election\nJan 2025\nTreasury Sanctions Entities in Iran and Russia That Attempted to\nInterfere in the U.S. 2024 Election\nInformation\n\njoint-odni-fbi-and-cisa-statement-on-iranian-election-influence-efforts\u003e\nLast change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=01106777-4eb0-4a37-b7d3-c8ca539e2403\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=01106777-4eb0-4a37-b7d3-c8ca539e2403\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=01106777-4eb0-4a37-b7d3-c8ca539e2403"
	],
	"report_names": [
		"showcard.cgi?u=01106777-4eb0-4a37-b7d3-c8ca539e2403"
	],
	"threat_actors": [
		{
			"id": "e453f9aa-a448-48c0-afcb-6495f5becdb9",
			"created_at": "2024-03-11T02:02:37.090237Z",
			"updated_at": "2026-04-10T02:00:04.989739Z",
			"deleted_at": null,
			"main_name": "[Unnamed groups: Iran]",
			"aliases": [],
			"source_name": "ETDA:[Unnamed groups: Iran]",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434244,
	"ts_updated_at": 1775791899,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/592bd697746fefc8f4a035319a80560cd312f6e0.pdf",
		"text": "https://archive.orkl.eu/592bd697746fefc8f4a035319a80560cd312f6e0.txt",
		"img": "https://archive.orkl.eu/592bd697746fefc8f4a035319a80560cd312f6e0.jpg"
	}
}