ZeroFox Intelligence Flash Report - Iranian Data Leak Advertised on the Dark Web

Product Serial: F-2024-06-10a

TLP:CLEAR

In this Flash Report, ZeroFox researchers report on the recent data breach advertised for sale in the dark web forum Onniforums, which targeted Iranian state organizations.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

On June 4, 2024, untested English-speaking actor “irleaks” announced the sale of a large leaked data set pertaining to an independent Iranian government agency, the Hajj and Pilgrimage Organization, on the dark web Onniforums community.
The leaked data will very likely attract threat collectives with geopolitical or ideological motivations, including hacktivist and state-sponsored groups hostile to Iran. Additionally, financially motivated threat actors, such as ransomware groups, will likely be interested.
The recent data leak is very likely related to the ongoing Israel-Hamas war, as threat actors likely identify a demand from geopolitically aligned actors for state-related data.
It is likely that data leaks implicating both Israel and Iran will continue to be advertised by threat actors on dark web forums while the conflict persists.