Worked example · 2018-20

Iranian state-aligned financially-motivated cyber operations — 2018–2025

Loss

Infrastructure case, not a per-victim loss. The cluster set comprising MuddyWater (MOIS-attributed), Charming Kitten/APT35 (IRGC-IO-attributed), and Pioneer Kitten/Fox Kitten/Lemon Sandstorm (IRGC-affiliated) has produced a documented cryptocurrency-economy exposure across ransomware-with-crypto-payments, cryptocurrency-mining intrusions, and OFAC-designated wallet clusters. The SamSam ransomware operation (2015–2018) — which extracted Bitcoin-denominated ransom payments from municipal and healthcare targets — was the first OFAC action to include cryptocurrency addresses as identifiers on the SDN List (November 2018), establishing a sanctions precedent. The Pay2Key ransomware operation of late-2020 is the canonical Iranian-state-aligned financially-motivated cryptocurrency-payment case for the cluster set.

OAK Techniques observed

OAK-T5.008 (Ransomware Extortion Payment) — SamSam and Pay2Key ransomware operations with Bitcoin-denominated ransom payments. OAK-T7.002 (CEX Deposit-Address Layering) — Iranian ransomware operators routed proceeds through non-KYC exchanges and instant exchangers to evade sanctions. OAK-T8.001 (Cluster Reuse / Operator Fingerprinting) — the cluster set's distinctive TTP fingerprint (PowGoop/NativeDropper loaders, IRGC/MOIS attribution partition, cryptocurrency-mining-on-compromised-systems xmrig deployments) enables identification distinct from Russian-language RaaS clusters.

OAK-Gnn

OAK-G13 Iranian crypto operators.

Attribution

confirmed at the cluster-set-and-state-attribution level — multiple OFAC SDN designations across 2018–2024 ([ofac2018samsam], [ofac2020apt39], [ofac2022irgcyber]); CISA AA22-257A "Iranian IRGC-Affiliated Cyber Actors" (September 2022, [cisa2022aa22257a]); CISA AA22-055A "Iranian Government-Sponsored MuddyWater Actors" (February 2022, [cisa2022aa22055a]); FBI Flash on Pioneer Kitten (August 2024, [fbi2024pioneerkittenflash]); January 2022 U.S. Cyber Command attribution of MuddyWater to MOIS. Attribution that specific cryptocurrency-theft or ransomware-payment incidents are downstream of a specific Iranian sub-cluster placement is inferred-strong in many cases.

Key teaching point

The Iranian cluster set is the structurally distinct third leg (alongside DPRK and Russian-language RaaS) of OAK's state-aligned-financially-motivated actor taxonomy. The November 2018 OFAC designation of two Iranian nationals for laundering SamSam ransomware proceeds — the first OFAC inclusion of cryptocurrency addresses as identifiers on the SDN List — is the foundational sanctions precedent for cryptocurrency-address-based sanctions enforcement. The cluster set demonstrates the "sanctions-busting cryptocurrency usage" pattern: Iranian operators, cut off from the SWIFT and correspondent-banking networks by U.S. and UN sanctions, use cryptocurrency as both a ransom-payment rail and a sanctions-circumvention mechanism.

MuddyWater (MOIS-attributed)

Primary mission is intelligence collection against government and telecommunications targets in the Middle East; cryptocurrency-mining intrusions on compromised systems are a supplementary monetisation channel. The cluster's cryptocurrency-economy footprint is the smallest of the three sub-clusters but is included in OAK-G13 because of the broader IRGC/MOIS shared substrate and the OFAC-designated-wallet-cluster overlap.

Charming Kitten / APT35 (IRGC-IO-attributed)

Primary mission is intelligence collection and information operations against Iranian diaspora, academic, and policy targets; cryptocurrency-economy exposure includes credential-harvesting operations against cryptocurrency exchange employees and crypto-journalists, and limited ransomware-adjacent activity documented in industry-forensic reporting.

Pioneer Kitten / Fox Kitten / Lemon Sandstorm (IRGC-affiliated)

The most financially-aggressive of the three sub-clusters; operations include ransomware deployments (Pay2Key, late-2020), cryptocurrency-mining on compromised DIB and engineering systems, and network-access brokering to ransomware affiliates. The FBI's August 2024 Flash characterised Pioneer Kitten as an IRGC-affiliated access broker with sustained ransomware-affiliate partnerships.