Country

Ransomware attacks in Iran

Ransomware groups have listed 32 organisations from Iran on their leak sites since February 2023; the latest post is from 12 August 2026. Most active groups: Arvinclub, Handala and Apt73. Most affected sector: Manufacturing.

Total posts 32
First seen 2023-02-22
Latest post 2026-08-12
Groups 20

Ransomware victims in Iran per year

11 2023
5 2024
8 2025
8 2026

All 32 victims

Search every post in the full table.
Victim Group Sector Discovered
IRCO.COM Clop
azarestan.com Apt73 Other
Nobani Co Deadlock Other
Shajarpak Securities Thegentlemen Financial Services
sansirostadium.com Apt73 Hospitality
IranWire Handala Technology
Who is VahidOnline? Handala Technology
IDF in Farsi Handala Government & Defense
behranlift.com Lockbit5 Manufacturing
taminsho.com Benzona Retail & E-Commerce
Parsirang Dragonforce Agriculture and Food Production
SWISS ROSE Factory Nova Manufacturing
Qatargas and Tar Company, Iran Tengu Energy & Utilities
Iran International Handala Technology
Iran gas service system Babuk2 Energy & Utilities
Rahnama Law Frag Professional Services
amlakparto.ir Dragonransomware Professional Services
www.cobeldarou.com Ransomhub Healthcare
Barid soft Stormous Technology
voidinteractive.net you are welcome in our chat Donutleaks Technology
www.loghmanpharma.com Stormous Healthcare
Islamic Azad University Electronic Campus Arvinclub Education
Kimia Tadbir Kiyan Arvinclub Manufacturing
Islamic Azad University of Shiraz Arvinclub Education
Pasouk biological company Arvinclub Agriculture and Food Production
abzarsara.com Lockbit3 Manufacturing
Sabalan Azmayesh Arvinclub Healthcare
Draje food industrial group Arvinclub Agriculture and Food Production
hamyari Shahrdari golestan Arvinclub Government & Defense
Padena Factory Arvinclub Manufacturing
Rouzbeh Educational Complex Rhysida Education
RAYAB Consulting Engineers Medusa Professional Services