Iranian State-Sponsored Threat Actor
Executive Summary
Seedworm (also known as Seedworm, Seedworm, Iranian APT) is an Iranian state-sponsored advanced persistent threat group primarily focused on critical infrastructure targeting, financial fraud, and espionage. This report covers their operations as of 2026, including their recent campaigns, tools, TTPs, and target sectors.
Basic Information
- Name: Seedworm
- Aliases: Seedworm, Seedworm, Iranian APT
- MITRE ATT&CK Group ID: G0053
- Country of Origin: Iran
- Threat Level: HIGH
- Primary Motivation: Critical infrastructure targeting, financial fraud, espionage
Recent Operations (2025-2026)
Critical Infrastructure (2025-2026):
- U.S. bank targeting
- Airport network operations
- Software vendor operations
- Power grid targeting
Financial Sector (2025-2026):
- Banking infrastructure operations
- Financial institution compromise
- Payment processor targeting
- ATM network operations
Primary Tools:
- Cobalt Strike (primary post-exploitation)
- Custom malware (Seedworm framework)
- Spearphishing campaigns
- Zero-day exploitation
- Credential dumping (Mimikatz, BloodHound)
TTPs (MITRE ATT&CK Mapping)
Initial Access:
- Phishing (Spearphishing Link, Spearphishing Attachment)
- Exploit publicly available vulnerabilities
- Supply chain compromise
Execution:
- Browser Execution
- PowerShell
- Command and Scripting Interpreter
Persistence:
- Boot/Logon Autostart
- Accessibility Features
- Lateral Tool Transfer
Privilege Escalation:
- Exploitation for Privilege Escalation
- Abuse Elevation Control Mechanism
Defense Evasion:
- Indicator Removal
- File and Directory Permissions Modification
- Obfuscated Files or Information
Credential Access:
- Credential Dumping (LSASS Memory)
- Remote Service Discovery
Discovery:
- Active Directory Enumeration
- Network Service Discovery
Lateral Movement:
- Remote Services (RDP, SMB)
- Remote Services (SMB)
Collection:
- Data from Local System
- Data from Network
Exfiltration:
- Exfiltration Over C2 Channel
- Exfiltration Over Alternative Protocol
Known Campaigns (2025-2026)
Operation 1 (2025):
- Target: U.S. bank networks
- Impact: Banking infrastructure compromise
- Tools: Cobalt Strike, custom malware
Operation 2 (2025):
- Target: Airport networks
- Impact: Airport IT system compromise
- Tools: Cobalt Strike, Mimikatz
Operation 3 (2026):
- Target: Software vendor networks
- Impact: Software supply chain compromise
- Tools: Cobalt Strike, spearphishing
Threat Assessment
Threat Level: HIGH
Primary Targets:
- Critical infrastructure
- Banking sector
- Airport networks
- Software vendors
Capabilities:
- Critical infrastructure targeting
- Financial fraud
- Multi-vector attacks
- Long-term persistence
- Supply chain attacks
Sources
- CISA Advisories
- Security.com
- CrowdStrike Threat Intelligence
- Mandiant Reports
- FortiGuard Labs
- Brandefense
- NSFOCUS
- National Intelligence Service
Report Generated: 2026-06-10
Intelligence Freshness: Current (as of June 2026)
Classification: Unclassified