Nation-State Cyber Espionage: Iran’s Shahid Shushtari Unit and the $10M Bounty
In late 2024, security authorities announced a $10 million reward for information regarding the whereabouts of Mohammad Bagher Shirinkar and Fatemeh Sedighian Kashi, key leaders of Shahid Shushtari — a cyber unit operating under Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command. Known by threat intelligence analysts as UNC5866, Cotton Sandstorm, and Haywire Kitten, the group targets critical infrastructure sectors, including news, shipping, travel, energy, financial services, and telecom across the U.S., Europe, and the Middle East. Their operations span spear-phishing, malware campaign delivery, and cyberespionage, with significant disruptions and financial damages reported. Notably, the group attempted to influence the 2020 U.S. presidential election and continues its multi-pronged attacks using evolving techniques and new tradecraft. This incident underscores the persistent and evolving threat posed by nation-state actors targeting both public and private institutions globally. Increased vigilance, timely intelligence sharing, and robust controls around east-west network traffic and encrypted communications are now critical countermeasures as similar attacks escalate.
Kill Chain
