Report: Iranian APT Actors Regroup After Main Security Forum Shuts Down

Recorded Future reports that the shutdown of Iran’s Ashiyane security forum has pushed Iran-linked APT actors to migrate to other forums (e.g., VBIran.ir and Persian Tools), potentially enabling renewed collaboration and future offensive cyber operations. The analysis links Ashiyane and its founder to IRGC-associated campaigns, summarizes past destructive and espionage operations attributed to Iranian actors, and warns that mounting political and economic pressures on Iran increase the likelihood of cyber retaliation.