Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
IR

Ransomware attacks in Iran

25 organisations in Iran have been listed on ransomware leak sites, ranking #56 worldwide. Updated .

Victims
25
0.1% of global total
Global rank
#56
of 181 countries
Active groups
18
Most: Handala
Sectors
11
Most: Healthcare

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Iran. Figures are computed from the tracked records, not inferred.

Iran has seen ransomware attack activity recorded against 25 victims globally placing it at rank 56 on that scale with notable groups Krybit and Handala most active, targeting sectors like healthcare, manufacturing, and technology.

Iran in the global picture

Iran accounts for 25 of the ransomware disclosures tracked here, ranking #56 worldwide and making up 0.1% of the global total. The sectors listed most often are Healthcare, Manufacturing, Technology.

Who is most active in Iran

Handala — 4 victims in Iran. Not a Ransomware Group. Krybit — 2 victims in Iran. Wallstreet — 2 victims in Iran.

Ransomware threat profile: Iran

Iran ranks #56 worldwide for ransomware disclosures, with 25 victims in this database — 0.1% of the global total. The groups listing the most organisations here are Handala, Krybit and Wallstreet.

The most frequently listed industries in Iran are Healthcare, Manufacturing, Technology. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

The volume reflects Iran's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Iran 25

Organization Disclosed
daralteb.com
Krybit
daralteb.com
Krybit
Roshd Sanat
Wallstreet
Roshd Sanat
Wallstreet
IRCO.COM
Clop
azarestan.com
Apt73
Nobani Co
Deadlock
Shajarpak Securities
Thegentlemen
sansirostadium.com
Apt73
IranWire
Handala
Who is VahidOnline?
Handala
IDF in Farsi
Handala
behranlift.com
Lockbit5
taminsho.com
Benzona
Parsirang
Dragonforce
SWISS ROSE Factory
Nova
Qatargas and Tar Company, Iran
Tengu
Iran International
Handala
Iran gas service system
Babuk2
Rahnama Law
Frag
amlakparto.ir
Dragonransomware
www.cobeldarou.com
Ransomhub
Barid soft
Stormous
voidinteractive.net you are welcome in our chat
Donutleaks
www.loghmanpharma.com
Stormous

Frequently asked questions

How many ransomware attacks have occurred in Iran?

Iran has recorded 25 ransomware victim disclosures in this database, ranking #56 globally. This represents 0.1% of all tracked ransomware attacks worldwide.

Which ransomware groups target Iran?

The ransomware groups most active in Iran are Handala, Krybit, Wallstreet, Apt73. These groups collectively account for the majority of victim disclosures attributed to Iran.

Which industries are most targeted by ransomware in Iran?

In Iran, the most frequently targeted sectors are Healthcare, Manufacturing, Technology. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Iran rank globally for ransomware attacks?

Iran ranks #56 globally for ransomware attacks with 25 victim disclosures, representing 0.1% of the worldwide total of 23,674 tracked victims.

How can organisations in Iran protect against ransomware?

Organisations in Iran should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Iran is also recommended.