IRLeaks
IRLeaks is a threat actor known for significant cyberattacks targeting Iranian organizations, including a major breach of SnappFood, where they exfiltrated 3TB of sensitive data from 20 million user profiles. They have also compromised data from 23 leading Iranian insurance companies, offering over 160 million records for sale. Their operations involve extortion tactics, as seen in the ransom negotiations with Tosan, and they utilize malware such as StealC for data extraction. IRLeaks communicates primarily in Persian and has been active in selling stolen data on cybercriminal marketplaces.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.hackread.com/iranian-food-delivery-snappfood-cyber-attack/
- https://cisoseries.com/cyber-security-headlines-google-5b-suit-settled-orbit-chain-loses-80m-fda-cyber-agreement/
- https://www.oodaloop.com/briefs/2024/01/04/pilfered-data-from-iranian-insurance-and-food-delivery-firms-leaked-online/
- https://cybershafarat.com/2024/09/04/major-ir-leaks/
- https://www.scmagazine.com/brief/significant-ransom-payment-by-major-iranian-it-firm-underway
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.