Actors Insights|Latest update03/12/2024

Rana Cluster

Suspected state sponsor: Islamic Republic of Iran

The Rana Intelligence Computing Company, or Rana Cluster, is a front company for the Iranian Ministry of Intelligence's (MOIS) cyber espionage efforts, disseminating a years-long malware campaign. Rana's primary targets are individuals, including journalists, former government employees, activists, university students, academics, and employees at international non-government organizations inside and outside Iran, as well as travel and hospitality enterprises across Asia, Africa, Europe, and North America, including Iran. Rana’s primary duty is to collect intelligence about persons and entities deemed threats by the MOIS. 

 

Rana Cluster's primary method of hacking is by using spear phishing and sending malware to the targets that allow them to get access to the target’s machine and exfiltrate data. The main focus of Rana in terms of malware development has been on Microsoft Office.

Most Common Tactics

Targeted Regions

Afghanistan
AF
Afghanistan
Afghanistan
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Egypt
EG
Egypt
Egypt
Dec 2018 ~ Jan 2019
Dec 2018 ~ Jan 2019
Europe
EU
Europe
Europe
Sep 2020 ~ Sep 2020
Germany
DE
Germany
Germany
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Iran
IR
Iran
Iran
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Dec 2014 ~ Dec 2020
Jun 2014 ~ Dec 2015
Dec 2014 ~ Dec 2020
Jun 2014 ~ Dec 2015
Dec 2014 ~ Dec 2020
Jun 2014 ~ Dec 2015
Dec 2014 ~ Dec 2020
Dec 2014 ~ Dec 2020
Dec 2014 ~ Dec 2020
Dec 2014 ~ Dec 2020
Dec 2014 ~ Dec 2020
Dec 2014 ~ Dec 2020
Sep 2018 ~ Jan 2019
Dec 2014 ~ Dec 2020
Sep 2018 ~ Jan 2019
Dec 2014 ~ Dec 2020
Dec 2014 ~ Dec 2020
Dec 2014 ~ Dec 2020
Sep 2020 ~ Sep 2020
Dec 2014 ~ Dec 2020
Iraq
IQ
Iraq
Iraq
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Dec 2018 ~ Jan 2019
Dec 2018 ~ Jan 2019
Israel
IL
Israel
Israel
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Dec 2018 ~ Jan 2019
Dec 2018 ~ Jan 2019
Jordan
JO
Jordan
Jordan
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Kuwait
KW
Kuwait
Kuwait
Dec 2018 ~ Jan 2019
Dec 2018 ~ Jan 2019
Middle East
ME
Middle East
Middle East
Sep 2020 ~ Sep 2020
Netherlands
NL
Netherlands
Netherlands
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Pakistan
PK
Pakistan
Pakistan
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Qatar
QA
Qatar
Qatar
Dec 2018 ~ Jan 2019
Dec 2018 ~ Jan 2019
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Dec 2018 ~ Jan 2019
Dec 2018 ~ Jan 2019
Singapore
SG
Singapore
Singapore
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Spain
ES
Spain
Spain
Dec 2018 ~ Jan 2019
Dec 2018 ~ Jan 2019
Sudan
SD
Sudan
Sudan
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Tajikistan
TJ
Tajikistan
Tajikistan
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Thailand
TH
Thailand
Thailand
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Turkey
TR
Turkey
Turkey
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Nov 2018 ~ Mar 2019
Dec 2018 ~ Jan 2019
Nov 2018 ~ Mar 2019
Dec 2018 ~ Jan 2019
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Jan 2017 ~ Feb 2018
Dec 2018 ~ Jan 2019
Dec 2018 ~ Jan 2019
United Kingdom
GB
United Kingdom
United Kingdom
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
United States
US
United States
United States
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Jun 2014 ~ Dec 2015
Dec 2018 ~ Jan 2019
Dec 2018 ~ Jan 2019
Sep 2020 ~ Sep 2020
Jan 2014Jul 2024

Targeted Sectors

PoliticalCommunicationTechnologyTransportJournalistsAerospaceHuman RightsPro-DemocracyDissidentGovernment Agencies and ServicesTourismTelecommunicationUniversityResearchersFinancials

Recent Activities

  1. Public
    Iranian APT39 Uses Android Malware for Domestic Surveillance
  2. Public
    Iranian APT39 Targets Global Sectors with Sophisticated Malware Campaign

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.