Treasury sanctions Iranian hackers tied to critical infrastructure breaches

MalBot · August 25, 2026, 3:45pm

The Treasury Department sanctioned five Iranian nationals on Monday over alleged cyberattacks and theft targeting U.S. critical infrastructure, government offices and digital assets.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

The designations were part of a<a href=“Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day | U.S. Department of the Treasury”> much broader sanctions package</a> that Treasury Secretary Scott Bessent billed as an “economic D-Day” aimed at isolating Iran and cutting off its sources of revenue during the ongoing war.

Treasury accused four of the individuals — Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh, Mohammad Reza Kadkhoda’i and Mojtaba Ghal’eh-Kuhi — of participating in a hacking operation directed by Iran’s Ministry of Intelligence and Security.

Blagh, Balujeh and Kadkhoda’i allegedly carried out most of the group’s intrusions. Since late 2023, they have breached and stolen data from U.S. energy companies, defense contractors, health care institutions, technology firms and financial institutions, according to the department. The three are believed to have also compromised several local, state and federal government offices during the summer of 2024.

Treasury said Ghal’eh-Kuhi and Behzad Mesri, who was previously sanctioned in 2018, have led the group since at least 2023. The hackers regularly conducted operations for the intelligence ministry, though officials said personal profit also played a significant role in their activity.

The department separately sanctioned Arman Kahzadian, another alleged member of the network who focused on digital asset theft. Treasury said Kahzadian illicitly took control of a cryptocurrency wallet holding more than $30,000 in Bitcoin in 2023.

Other members sometimes turned their attention to targets inside Iran. Ghal’eh-Kuhi and Balujeh allegedly stole data from an Iranian telecommunications company in 2025. Treasury said that activity reflected the hackers’ willingness to put their own financial interests ahead of work benefiting Tehran.

Four of the five people sanctioned Monday were also charged last week in the Justice Department’s<a href=“DOJ charges 17 Iranians in cybertheft campaign - Nextgov/FCW”> expanded case</a> against 17 Iranian cyber actors affiliated with the Mabna Institute. Prosecutors have accused the Tehran-based firm of conducting a sprawling hacking-for-hire campaign for Iran’s Islamic Revolutionary Guard Corps and other Iranian partners. The group allegedly breached universities, government agencies and companies while stealing more than 31 terabytes of academic research and intellectual property.

The sanctions come amid heightened concern about Iran’s ability to reach vulnerable U.S. infrastructure. CISA and the FBI have recently helped water utilities recover from<a href=“CISA still finds water system controls exposed online amid multistate hacks - Nextgov/FCW”> cyberattacks affecting at least 12 states</a>. Some U.S. officials suspect Iran-linked hackers were responsible, although CISA has not publicly attributed those intrusions.

Federal agencies also warned earlier this year that<a href=“Pro-Iran hackers are targeting US industrial control systems, advisory says - Nextgov/FCW”> </a>Iran-aligned groups were <a href=“Pro-Iran hackers are targeting US industrial control systems, advisory says - Nextgov/FCW”>targeting</a> industrial control systems used across the energy, water and government sectors.

The cyber sanctions were part of a broader package targeting nearly 60 people, companies and vessels tied to Iran’s nuclear and missile programs, oil trade and hacking operations. The moves block assets under U.S. control and generally prohibit Americans from doing business with those designated. Treasury also expanded sanctions categories to target people and companies operating in Iran’s digital assets, technology, gold, aviation and shipping sectors.

Article Link: Treasury sanctions Iranian hackers tied to critical infrastructure breaches - Nextgov/FCW