Iran-linked actors—particularly MOIS-associated groups such as Void Manticore and MuddyWater—are increasingly using criminal tools, malware-as-a-service, and cybercrime infrastructure to further state objectives while complicating attribution. This trend includes use of infostealers (Rhadamanthys), botnets (Tsundere/DinDoor), code-signing certificates shared across families, and ransomware branding (Qilin) in incidents such as the Shamir Medical Center intrusion. #VoidManticore #Rhadamanthys
Keypoints
- Iran-linked MOIS actors are shifting from merely posing as cyber criminals to actively leveraging criminal tooling, marketplaces, and affiliate models for state-directed operations.
- Void Manticore (Handala) used the commercial infostealer Rhadamanthys alongside custom wipers in phishing lures targeting Israeli organizations.
- MuddyWater has been associated with the Tsundere (DinDoor) botnet and overlaps with criminal malware clusters through shared infrastructure and code-signing certificates.
- CastleLoader (via FakeSet downloader) and other Malware-as-a-Service offerings appear in infection chains, suggesting use of affiliate-style ecosystems rather than exclusive in-house tooling.
- Shared code-signing certificates (Common Names “Amy Cherne” and “Donald Gay”) linked multiple malware families (FakeSet/CastleLoader, StageComp, DinDoor/Tsundere), indicating common certificate sources or resale.
- The Qilin-branded incident against Shamir Medical Center illustrates how ransomware-as-a-service branding can be used by Iranian-affiliated operators to enable and obscure strategic intrusions.
MITRE Techniques
- [T1566 ] Phishing – Used to deliver infostealers and wipers in targeted lures; quote: ‘…pairing it with one of its custom wipers in phishing lures aimed at Israeli targets, most dominantly impersonating F5 updates.’
- [T1059 ] Command and Scripting Interpreter – JavaScript runtimes (Node.js and Deno) used to execute code on compromised hosts; quote: ‘…when the Node.js engine is detected, the botnet shifts to an alternative execution method using Deno…’
- [T1105 ] Ingress Tool Transfer – Downloaders used to deliver secondary payloads (e.g., FakeSet delivering CastleLoader); quote: ‘…a downloader used in recent infection chains delivering CastleLoader.’
- [T1553 ] Subvert Trust Controls (Code Signing) – Use of code-signing certificates to sign malware and evade detection; quote: ‘…use of a set of code-signing certificates, specifically under the Common Names “Amy Cherne” and “Donald Gay”.’
- [T1567 ] Exfiltration Over Web Service / Cloud Storage – Use of rclone to access a Wasabi server for storage or transfer of data; quote: ‘…the use of rclone to access a Wasabi server…’
- [T1588 ] Obtain Capabilities – Leveraging Malware-as-a-Service and affiliate models (e.g., CastleLoader, Qilin) to obtain tooling and operational support; quote: ‘CastleLoader operates as a Malware-as-a-Service offering used by multiple affiliates.’
- [T1485 ] Data Destruction – Employment of wiper malware in disruptive attacks and hack-and-leak operations; quote: ‘…most commonly associated with “hack and leak” operations and disruptive attacks, particularly wiper operations.’
Indicators of Compromise
- [SHA256 hash ] Handala / Rhadamanthys and other samples – aae017e7a36e016655c91bd01b4f3c46309bbe540733f82cce29392e72e9bd1f, 077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de, and 12 more hashes.
- [Certificate Common Name ] Code-signing certificates used to sign malware – Amy Cherne, Donald Gay.
- [Certificate Thumbprint ] Identifiers for suspicious certificates – 0902d7915a19975817ec1ccb0f2f6714aed19638, 389b12da259a23fa4559eb1d97198120f2a722fe.
- [Certificate Serial Number ] Certificate serials tied to signed samples – 330007f1068f41bf0f662a03b500000007f106, 3300079a51c7063e66053d229b000000079a51.
- [IP address ] Infrastructure linked to MuddyWater activity and Wasabi access – 18.223.24[.]218 (rclone/Wasabi access linked to MuddyWater-associated infrastructure).
- [Malware family / Tool ] Named tools and families observed in campaigns – Rhadamanthys (infostealer), CastleLoader / FakeSet (downloader/MaaS), Tsundere / DinDoor (botnet), StageComp (and others).
- [Affected Organization ] Targeted entity referenced in incident reporting – Shamir Medical Center (Qilin-branded data leak/incident).
Read more: https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection/