Blurring the Lines: How Iranian State Hackers are Weaponizing RaaS and the Cybercriminal Underground

Check Point Research reports that Iranian intelligence-linked groups have shifted from imitating cybercriminals to actively leveraging the cybercrime ecosystem—purchasing commercial malware, using info-stealers like Rhadamanthys, deploying custom wipers, and participating as affiliates in Ransomware-as-a-Service operations—complicating attribution and enabling high-impact attacks such as the reported 8 TB breach of Shamir Medical Center.