Cybercrime isn't just a cover for Iran's government goons - it's a key part of their operations

Check Point Research reports that Iranian government-linked operators (MOIS-associated MuddyWater and Void Manticore) are increasingly using commercial cybercrime infrastructure—infostealers (Rhadamanthys), loaders (CastleLoader), and ransomware—alongside custom tools (DinDoor, Tsundere) in espionage, destructive campaigns, and attacks on Israeli hospitals and US critical networks; this blending of state and criminal tooling is used to obfuscate attribution.