U.S. Sanctions Iranian Hackers Targeting Critical Infrastructure
New economic measures aim to disrupt cyber threats linked to Iran's regime.
1Operation Economic Outcast
The U.S. Treasury launched unprecedented sanctions against nearly 60 Iran-linked entities across nuclear, missile, and cyber networks. Secretary Scott Bessent declared an 'economic onslaught' to sever Tehran's global financial connections. The campaign specifically targets digital assets used by the Islamic Revolutionary Guard Corps (IRGC). This marks the most comprehensive effort to financially isolate Iran's regime to date.
2Mabna Institute Hackers
Five individuals tied to Tehran's Mabna Institute face indictments for breaching U.S. critical infrastructure since late 2023. Keyvan Fayyaz Ghareh Blagh and associates allegedly infiltrated energy firms, defense contractors, and healthcare systems. Treasury reports show these hackers balance MOIS-directed cyber espionage with personal profit motives. Some even targeted Iranian companies, prioritizing personal enrichment over state objectives.
3Cryptocurrency Heists
Blockchain analysis reveals Mabna members moved $16.8 million through 30 wallets. Keyvan Fayyaz controlled 10 addresses handling 92% of network volume ($15.5M from 2018-2026). Arman Kahzadian stole $30,000 in Bitcoin during 2023. Behzad Mesri's 15 wallets processed $1.2 million. TRM Labs identified $202,662 remaining across all wallets. These findings demonstrate Iran's use of crypto to bypass traditional financial sanctions.
4UK Front Companies
British-based Zedcex and Zedxion allegedly funneled $1 billion to IRGC, according to TRM Labs' January disclosure. DomainTools' follow-up confirmed these exchanges exhibit classic financial façade patterns. Ari Redbord of TRM Labs notes secondary sanctions now threaten any platform doing business with Iran. 'Operation Economic Outcast targets both on-chain and off-chain isolation,' emphasizing global compliance pressure.
5Critical Infrastructure Attacks
Iranian hackers compromised over 30 U.S. water utilities across 12 states since 2026. They breached FBI Director Kash Patel's email and caused a 4-day UK power plant shutdown (per The Telegraph). While the UK government downplayed systemic risks, these incidents reveal persistent threats to operational technology. The attacks align with increased cyber activity following U.S.-Israel airstrikes against Iran in February 2026.
6$10 Million Bounty
The State Department's Rewards for Justice program offers up to $10 million for information on state-sponsored cyber attacks against U.S. infrastructure. This complements Treasury sanctions by incentivizing global cooperation against Iranian threat actors. The bounty system specifically targets foreign government-directed malicious cyber activities, creating additional pressure points beyond economic measures.
7Multifaceted Cyber Threat
SentinelOne characterizes Iran's operations as diverse clusters with distinct missions—from data destruction to dissident surveillance. Security researcher Tom Hegel warns compromised accounts enable 'access optionality,' allowing single breaches to support multiple objectives. Recent incidents demonstrate capabilities ranging from social engineering to cloud compromises and OT targeting, showcasing adaptable tradecraft across sectors.
8Financial Isolation Strategy
Experts confirm sanctions aim to block Iran from both traditional finance and blockchain transactions. The focus on digital assets reflects concerns about cryptocurrency enabling sanction evasion. By disrupting funding channels, the U.S. seeks to degrade Iran's cyber warfare capabilities. This two-pronged approach—economic pressure and cyber defense—represents a new phase in countering state-sponsored threats.
Original article: The Hacker News — ABD, İran Bağlantılı Siber Saldırganlara Yaptırım Uyguladı