Leaks and Links: Revealing Iran’s Cyber Operations via Bank Breaches and Telegram Networks

Cyber operations are a central feature of modern conflict with breached data serving both as a national security threat and a window into adversarial strategy. This session explores how compromised PII from Darkside with the investigative platform Falkor can illuminate the operational footprint of key actors within Iran’s cyber command structure. Focusing on one of the principal operators tied to the Iranian COBALT MIRAGE threat actor network, this investigation draws on leaked datasets from Iranian banks such as Mellat, Melli, and Saderat to surface new insights into covert communication networks, financial infrastructure, and strategic coordination efforts. The session also reveals previously hidden Telegram channels linked to figures within the inner circle of Iran’s Supreme Leader and outlines how these digital assets intersect with Iranian intelligence. Key takeaways include: - Identification of a central COBALT MIRAGE operator with connections to Iranian intelligence services - Analysis of digital infrastructure and coordination methods used by state-backed cyber units - Discovery of concealed Telegram networks tied to high-level regime figures - Traces of front companies linked to Iranian and foreign threat actors As cyber warfare continues to evolve, this session highlights the tools and techniques used to investigate complex cyber actors, showing how breached data and investigative platforms are reshaping open-source intelligence. Attendees will also have the opportunity to explore data from Darkside within Falkor’s platform and see how it can be applied to their own DarkINT investigative workflows.