APT / THREAT GROUP

Shamoon Group

🇮🇷Iran-attributed

aliases

Last seen:Apr 13, 2026

Intelligence Profile

Shamoon Group is an Iran-linked threat actor associated with destructive Shamoon wiper operations targeting organizations in the Middle East, especially in the energy sector.

Threat Analysis

Shamoon Group is a known-sophistication threat actor attributed to Iran, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.cfr.org/cyber-operations/shamoon

→https://securelist.com/shamoon-2-0-the-return-of-the-disttrack-wiper/77232/

→https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a

Quick Facts

TypeAPT / Threat Group

Origin🇮🇷 Iran

Aliases2

SourceMalpedia

Also Known As

Cutting Sword of JusticeShamoon Group

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Shamoon Group