Shahid Kaveh Group

Shahid Kaveh Group is an Iranian IRGC-linked hacktivist persona active since at least early 2026, named after a martyred IRGC figure. The group has been associated with cyberattacks targeting critical infrastructure, including attacks on industrial control systems in Israel and other countries. Shahid Kaveh Group activity overlaps with the broader CyberAv3ngers cluster — which the US government formally attributed to the IRGC Cyber Command in 2024 — and follows the same pattern of targeting internet-exposed operational technology devices to amplify geopolitical messaging. The group uses Telegram channels to claim attacks and publish evidence of compromised systems.