Principal Threat Intelligence Analyst at BAE Systems Digital Intelligence
Saher Naumaan is a Principal Threat Intelligence Analyst at BAE Systems Digital Intelligence. She currently researches state-sponsored cyber operations with a focus on tracking threat groups and activity from Iran and North Korea. Saher was also previously a fellow at the European Cyber Conflict Research Initiative (ECCRI).
The past two years have seen a rise in the “hacktivist style persona” in Iranian cyber-enabled influence operations. Several hacktivist personas have appeared, often in reaction to political events, to amplify pro-Iranian messaging, claim destructive attacks, and leak data. The onset of the Israel-Hamas conflict in October 2023 compounded the use of this tactic and brought Israel targeting sharply into focus. Employing influence campaigns specifically to support destructive operations has often been the purview of Iran's Ministry of Intelligence and Security (MOIS), which appears to follow a recognisable playbook. The Islamic Revolutionary Guard Corps (IRGC) carries out parallel but diverging activity, deploying personas but operating them differently. This talk will cover the stages often followed by MOIS-linked groups in their destructive and influence operations, as well as example personas linked to MOIS-affiliated actors. This will be followed by a look at IRGC actors and personas, and then a comparison of actors, personas, and TTPs across both agencies, ultimately to show how these influence operations support Iran’s objectives of undermining the government, intimidating the populace, and retaliating against Israeli hostility.