What is Iranian MOIS and its role in cyber attacks?

MOIS, Iran's Ministry of Intelligence and Security, runs state-sponsored hacks targeting enemies like Israel and the West. Now they're leaning on cyber criminals for tools and cover.

How are Iranian actors using cyber crime ecosystems?

Buying malware, access, and services from dark web markets to execute espionage and sabotage while hiding in plain sight among ransomware gangs.

What should companies do about Iranian MOIS cyber crime links?

Layer behavioral detection, monitor crypto flows tied to threats, and scan for hybrid TTPs—don't rely on old sigs alone.

🌐 Nation-State Threats

Iran's Spy Agency Dives into the Cyber Crime Underworld

Iran's intelligence pros aren't playing solo anymore. They're plugging into the cyber crime bazaar, blending state espionage with criminal hustle.

theAIcatchup Apr 08, 2026 4 min read

Digital map linking Iranian flags to dark web cyber crime nodes

⚡ Key Takeaways

Iranian MOIS actors are directly engaging cyber crime markets for tools and ops, beyond mere cover. 𝕏
This shift enables better attribution evasion, echoing Cold War spy-crime ties. 𝕏
Defenses must evolve to hunt ecosystem links, or risk hybrid threats exploding. 𝕏

Published by

theAIcatchup

Threat intelligence. Zero noise.

#Check Point Research #Iranian MOIS #cyber crime ecosystem #state-sponsored hacking

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by Check Point Research

⚡ Key Takeaways

The 60-Second TL;DR

theAIcatchup

Share this article

Worth sharing?

Related Stories

Check Point's 2025 Threat Secrets: Hidden Clues to Tomorrow's Attacks

Solo Hacker + AI = Pro Malware in Days: The VoidLink Wake-Up Call

Trivy Supply Chain Attack Cracks Open EU Commission's Europa.eu—Supply Chain's New Frontline

Inside Check Point's March 23 Threat Report: Navia's 2.6 Million Record Nightmare

Stay in the loop