Overview
Nasir Security is a pro-Iranian threat actor that emerged around October 2025, primarily targeting energy sector organizations in the Middle East (UAE, Oman, Saudi Arabia, Iraq) and Israeli IT supply chain firms, using spear-phishing, BEC, and exploitation of public-facing applications.
- First tracked: 2025-10-11
- Discussed in our reports: Gulf summary · Kuwait · Oman · UAE
Geography: origin and targets
Assessed origin: Islamic Republic of Iran. Described in public tracking as a pro-Iranian threat actor. Alignment, not a proven operator location. Attribution is uncertain: read it as an assessment, not proof.
No victim-country data for this group yet.
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
None recorded in the sources we reviewed.
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| Nasir Security | DLS | yzcpwxuhbkyjnyn4qsf4o5dkvu6m2fyo7dwizmnlutanlmzlos7pa6qd[.]onion | No |
| Nasir Security | DLS | nasir[.]cc | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11