Iranian state-backed spies pose as ransomware slingers in false flag attacks

An Iranian state-sponsored espionage group is pretending to be a regular ransomware gang in a new wave of ransomware attacks targeting enterprises.

APT group detailing the attack.

“If defenders see a ransom note, leak-site pressure, or a known ransomware brand, the initial response often focuses on business disruption, data theft, and negotiation,” said Christiaan Beek, VP of Cyber Intelligence at Rapid7. “That can distract from the deeper question of what access did the actor establish, what persistence remains, and what intelligence value did they gain.”

The incident highlights the increasing convergence between state-sponsored intrusion activity and cybercriminal tradecraft, according to Rapid7.

ChamelGang, a China-nexus espionage group, has been reported using ransomware to disguise espionage activity. North Korean state-linked groups have also used ransomware and cybercrime tactics, although often for revenue generation rather than pure deception.