Iranian state-backed spies pose as ransomware slingers in false flag attacks

Adopting criminal tactics enables these state-aligned actors to introduce ambiguity and delay defensive response, according to Rapid7, which today published a technical blog post detailing the attack.

“If defenders see a ransom note, leak-site pressure, or a known ransomware brand, the initial response often focuses on business disruption, data theft, and negotiation,” said Christiaan Beek, VP of Cyber Intelligence at Rapid7. “That can distract from the deeper question of what access did the actor establish, what persistence remains, and what intelligence value did they gain.”

The incident highlights the increasing convergence between state-sponsored intrusion activity and cybercriminal tradecraft, according to Rapid7.