Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
nasirsecurity Ransomware Group
Ransomware group profile
Description
Nasir Security is a politically motivated cybercriminal group that emerged in late 2025, linked to Iran and operating under various aliases. Their operations focus on cyber warfare and propaganda, utilizing tactics such as data theft, supply chain attacks, and disinformation strategies rather than financial gain alone.
Key insights
- •Uses business email compromise and spear phishing to gain initial access.
- •Focuses on supply chain attacks to evade direct defenses of larger organizations.
- •Employs insecure cloud storage services for data exfiltration.
- •Engages in direct and double extortion, leveraging data leak sites.
- •Combines propaganda with cyber operations to exaggerate the scale of breaches.
Threat Level & Status Breakdown
For nasirsecurity · Based on incidents in selected period
No victim data for this group in the selected period.
Recent activity
Monthly attack count for nasirsecurity in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for nasirsecurity
- nasir.cc
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for nasirsecurity
T1486
T1486
T1490
T1490
T1021
T1021
T1562
T1562
T1078
T1078
T1547
T1547
T1059
T1059
T1566
T1566
T1530
T1530
T0819
T0819
T1656
T1656
Affected countries(7)
Countries where this group has been reported to target or leak victims.