Search threats, CVEs… ⌘K
← Back to all threat actors

nasirsecurity

Nasir Security is a pro-Iranian threat actor that emerged around October 2025, primarily targeting energy sector organizations in the Middle East (UAE, Oman, Saudi Arabia, Iraq) and Israeli IT supply chain firms, using spear-phishing, BEC, and exploitation of public-facing applications.

How we source and review actor profiles
Motivation
ransomware
Last seen
2026-04-15
Sectors
technology
Status
Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
RelationshipSame as relationship with nasir security

The cited upstream records use spacing or punctuation variants of the same actor name. Source records remain separate for provenance, while exact-name resolution prefers the reviewed canonical profile.

High
First listed
Victim claimYad Vashem Museum Hacked! listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator2 indicators cataloged

Types: domain, onion.

First listed
Victim claimKuwait Ministry Of Interior Hacked! listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimDubai Airport - Data Leaked listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimUAE Customs (Federal Customs Authority) - ACCESS GRANTED ! listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimThe Most Massive Hack Operation in UAE History. It's Just The Beginning of Nightmares... listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimThe Most Massive Hack Operation in UAE History and Its Just The Bigginig the Nightmare Tha listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimAl-Safi Oil Company (PURE IN) Hacked listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimRumaila Operating Organisation Compromised listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimOman CC Energy Development Hacked listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimDubai Petroleum Breached listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimMission Announcement listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimFirst Statment listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
First listed
Victim claimTaldor Hacked listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimTaldor listed by nasirsecurity

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

nasirsecurityCanonical Name

Shared-name reviews

Every exact-name collision is reviewed. Same-actor decisions select a preferred profile while distinct and unresolved clusters remain separate.

Same actor high
nasirsecurity preferred nasir security

The cited upstream records use spacing or punctuation variants of the same actor name. Source records remain separate for provenance, while exact-name resolution prefers the reviewed canonical profile.

Same as: nasir security

Loading CVEs, techniques, indicators, malware, victims, and activity...