Iran cyber operations exposed in reports from Google, Microsoft

Mandiant and Microsoft reports detail Iran-linked intelligence-gathering operations using over 40 fake recruiting websites and fake social media profiles to collect personal data on Farsi speakers, dissidents, and foreign collaborators, and a separate IRGC-linked group (Peach Sandstorm) deploying custom Tickler malware against satellite, communications, oil & gas, and government targets; the campaigns span from at least 2017 through March–July 2024 and combine social engineering with malware-driven espionage.