Destructive attacks that targeted Iran’s transport ministry and national train system were coordinated by a threat actor dubbed Indra, who previously deployed wiper malware on the networks of multiple Syrian organizations.
Last month, Iran’s railways and transport ministry were hit by a cyberattack that took down their websites and disrupted train service throughout the country.