Iran captures cybercriminal accused of leaking military secrets to foreign media

Iran’s Islamic Revolutionary Guard Corps (IRGC) has announced the arrest of the leader of the online hacking group “Backdoor” (3ackdOor), accusing him of ties to anti-regime media outlets and intelligence networks associated with Israel’s Mossad and other Western services.

The suspect, an Iranian man whose identity has not been publicly released, reportedly operated under a fake online persona posing as a Dutch woman advocating for Iranian women’s rights, Al-Monitor reports, citing Iranian media outlet Fars.

The IRGC’s Intelligence Organisation has been investigating Backdoor since 2022, when the group began leaking personal information of morality police officers and other military personnel on social media platforms such as Twitter and Telegram. These leaks were subsequently used by foreign media, including the London-based Iran International, to publish reports on Iranian security personnel.

In video confessions released by Iranian state media, the suspect admitted to receiving cyber training and security courses abroad. Initially motivated by cryptocurrency earnings, he later provided sensitive information about the Quds Force, IRGC commanders, and their intelligence operations to foreign journalists and intelligence services for large payments.

The investigation indicates that the group collaborated with other actors, including the anti-regime hacking group Lab Dookhtegan and contacts linked to Mossad, to exert psychological pressure on Iranian leadership and, in some cases, plan targeted operations.

This arrest comes amid an intensifying cyber conflict between Iran and Israel, which escalated following the Israel-Hamas war in Gaza in October 2023 and continued through the 12-day war in June 2025. Recent months have seen cyberattacks from Israeli-linked groups against Iranian financial institutions, while Iranian-affiliated hackers, such as the group Cyber Toufan, have targeted Israeli defence contractors, leaking sensitive engineering and technical data.

Iranian authorities have also been intensifying their crackdown on alleged spies and collaborators. Between June and August 2025, at least 21,000 people were reportedly detained on accusations of working with Israel, with concerns growing over potential executions and long prison sentences.

In October, a man accused of collaborating with Mossad was executed, as was another individual, Bahman Choubi-asl, in September. According to Iran Human Rights, at least 1,271 executions were carried out in Iran in the first ten months of 2025, including 217 in October alone.

By Tamilla Hasanova