Microsoft says Iranian hackers expanding global cyber espionage
Fast-attack crafts from Iran's Islamic Revolutionary Guard Corps Navy swarming Panama-flagged oil tanker Niovi as it transits the Strait of Hormuz from Dubai to port of Fujairah in the United Arab Emirates, Persian Gulf, are seen in this screenshot of a video provided by the US Navy on May 3, 2023.
Iranian state-linked hackers are expanding their cyber operations beyond the Middle East to include targets in North America and Europe, according to Microsoft’s 2025 Digital Defense Report published on Thursday.
"Recently, three Iranian state-affiliated actors attacked shipping and logistics firms in Europe and the Persian Gulf to gain ongoing access to sensitive commercial data, raising the possibility that Iran may be pre-positioning to have the ability to interfere with commercial shipping operations," the report said.
In response, Iran’s mission to the United Nations denied the allegation, saying Tehran “is not the initiator of any offensive cyber operations against any country.”
The mission said Iran is a victim of cyberattacks itself and “will respond to any cyber threat in proportion to its nature and scope.”
Microsoft's report comes just days after Britain’s MI5 warned members of Parliament that spies from China, Russia and Iran are targeting UK politicians in an effort to influence policy, gather intelligence and undermine democracy.
On Tuesday, MI5 Director General Ken McCallum urged lawmakers to stay alert to blackmail attempts, phishing attacks, and approaches from individuals seeking to cultivate long-term relationships or make donations to sway decisions.
FBI director Kash Patel on Wednesday said the United States has seen a 50% increase in espionage cases linked to Iran.
US security agencies had warned in July of increased risk from Iranian cyber actors.
“Based on the current geopolitical environment, Iranian-affiliated cyber actors may target US devices and networks for near-term cyber operations,” the Cybersecurity and Infrastructure Security Agency (CISA) said in the report, issued jointly with the National Security Agency (NSA), Department of Homeland Security (DHS), and FBI.
MI5 Director General Ken McCallum said on Thursday that UK intelligence agencies were stepping up efforts to counter what he called mounting lethal plots by Tehran to silence dissidents on British soil.
"Iran's autocratic regime is ... frantically trying to silence its opponents around the world, including in the UK," he told reporters in a briefing.
"2025 has required us to grow our counter Iran effort," McCallum added. "MI5 has tracked more than 20 potentially lethal Iran-backed plots in just the one year since I last stood at this podium. The UK was among the first to call out this wave of Iranian transnational aggression. But we're far from alone."
The British government last month said it was determined to frustrate what it called escalating Iranian threats to people on UK soil, citing cyberattacks and the use of criminal proxies to carry out attacks.
"State threats are escalating. In the last year, we've seen a 35% increase in the number of individuals we're investigating for involvement in state threat activity," McCallum added, mentioning Russia and China as other key adversaries.
FBI Director Kash Patel said in a presentation to President Donald Trump and reporters in the White House on Wednesday that US law enforcement had stepped up arrests for Iran-backed espionage operations.
"The national security mission, Mr. President, under your leadership has never been stronger. We have gone after espionage activities against our main counterparts in China, Russia and Iran," he said.
"(On) Iran, we have had a 50% increase again in espionage cases."
Iran has not yet provided reports or set inspection dates for damaged nuclear sites under its Cairo access agreement with the International Atomic Energy Agency, Wall Street Journal correspondent reported on Thursday.
“While Iran has not binned or ended discussions with the IAEA on implementing the Cairo access deal, I understand it still hasn’t issued reports or given dates for issuing reports on damaged sites and stockpile. Nor of course permitted access to damaged sites,” Laurence Norman wrote on X. He said IAEA chief Rafael Grossi “is for now being given more space” but continues to press Tehran to advance on these steps.
The comments come as Iran’s Atomic Energy Organization chief Mohammad Eslami said on Wednesday that “no IAEA inspector is currently in the country.” Eslami said only two visits had been allowed since the June airstrikes on Iranian nuclear facilities — to Bushehr and Tehran reactors — both cleared by the Supreme National Security Council.
The Cairo deal, reached in September between Foreign Minister Abbas Araghchi and Grossi, was meant to restore limited cooperation after the strikes. It outlined “practical modalities” for monitoring declared nuclear sites, but Iranian officials warned the accord could collapse if UN sanctions were reinstated. Western governments triggered the snapback of those sanctions in late September, citing Iran’s failure to meet its obligations.
Eslami said Iran is not considering leaving the Nuclear Non-Proliferation Treaty but faulted the IAEA for failing to condemn the US and Israeli attacks. “The agency should have condemned the attack on Iran’s nuclear sites, but it did not,” he said, adding that Iran’s cooperation is now governed by a new parliamentary law limiting access.
Norman said the IAEA has so far avoided demanding immediate access to a specific site to prevent a direct refusal by Tehran, “risking a crisis.” He added that Iran “could play its old game of offering something ahead of [the] November IAEA board” but warned that without progress, “we could be running into another significant moment in November.”
A Norwegian court has sentenced a former security guard at the US embassy in Oslo to three years and seven months in prison for passing sensitive information to Russian and Iranian intelligence, the court said on Thursday.
The man told investigators he acted to protest US support for Israel’s war in Gaza.
The 28-year-old Norwegian, whose name has not been released, was found guilty of providing floor plans, personal details of embassy staff and their families, and information about activities at the mission between March and November 2024. The court said he received 10,000 euros ($11,700) from Russian intelligence and 0.17 bitcoin from Iranian intelligence in return.
During the trial, the defendant admitted to spying but denied aggravated espionage, saying the material he shared was not classified. He told the court his actions were motivated by opposition to Washington’s support for Israel’s military operations in Gaza.
The verdict comes amid heightened concern in Europe about foreign espionage and influence operations. Britain’s MI5 warned this week that intelligence agencies from China, Russia and Iran are targeting lawmakers to shape policy and collect information.
European authorities have also stepped up investigations into financial and cyber networks linked to Iran. In Germany, media reports said a Berlin businesswoman allegedly helped move Iranian oil revenues through front companies tied to the defense ministry. In Australia, police charged a Sydney man with sending nearly $650,000 to sanctioned Iranian banks.
Western intelligence services say Tehran has expanded its overseas operations in recent years through cyber activity, disinformation campaigns and the recruitment of local agents. Iran denies running espionage networks abroad and says it faces similar accusations meant to isolate it diplomatically.
Iran summoned Poland’s Chargé d’Affaires in Tehran on Thursday to protest Polish Foreign Minister Radoslaw Sikorski's participation in an event in the British Parliament that displayed a downed Iranian-made drone allegedly used by Russia in its war on Ukraine.
The exhibition, organized by the US-based advocacy group United Against Nuclear Iran (UANI), featured a Shahed-136 drone recovered in Ukraine and was intended, according to the group, to highlight Tehran’s role in aiding Moscow’s military campaign. Sikorski attended the event during a visit to London for meetings with British officials.
Earlier that day, Sikorski told reporters that a recent Russian drone incursion into Polish airspace was “tactically stupid and counterproductive,” saying it had only strengthened Western resolve against Moscow. The Polish minister said the drones appeared to have been launched deliberately from Russia and coordinated with Belarus.
Mahmoud Heidari, the Foreign Ministry’s director general for Mediterranean and Eastern European affairs, summoned Polish Chargé d’Affaires Marcin Wilczek and conveyed what he called Tehran’s “strong protest” over the London event. Heidari rejected what he described as “baseless and repetitive accusations” about Iran’s drone program and expressed regret over Sikorski’s involvement.
Iran’s Foreign Ministry said the move to exhibit the drone violated diplomatic norms and repeated politically motivated allegations about Iran’s role in the Ukraine conflict.
Iran denies supplying drones for use in the war, saying it sold a limited number to Russia before the invasion began. Western governments and Ukraine say Shahed-type drones, designed in Iran and now produced in Russia under the name Geran, have become central to Moscow’s air assaults. The Financial Times reported in July that the modified drones have tripled their success rate in hitting targets.
Polish officials have not publicly commented on the summons, but Warsaw has cooperated with UANI and Ukrainian forces in transferring a similar drone to the United States earlier this year for display at a political conference attended by US President Donald Trump.
Iran’s economic and social difficulties stem from mismanagement by its own officials rather than from US pressure, President Masoud Pezeshkian said on Thursday.
“We are lying on wealth yet remain poor because of ourselves — the managers, officials, politicians and lawmakers — not America,” Pezeshkian said at a meeting of education managers in the central city of Isfahan. He urged local authorities to depend on people’s capacities instead of waiting for the state to act. “If you rely on the government, nothing will change in fifty years. But if you trust the people, you can achieve anything,” he said.
Pezeshkian said the growing desire among young Iranians to emigrate was troubling and reflected a loss of faith in the country’s future. “Why should our children think about leaving?” he asked. “Going abroad to study and learn is not bad, but believing that they must go and never return is a disaster,” he said. The president urged young people to gain knowledge overseas and bring it back to serve their homeland.
Warning over internal conflict
Iran’s main threat comes from domestic divisions rather than from the United States or Israel, Pezeshkian said. “I am not afraid of America or Israel. I fear our own disputes,” he said. “If we fight each other, we do not need enemies. We destroy ourselves.”
Pezeshkian voiced similar concerns on Wednesday, saying at a cabinet meeting that political infighting was a greater danger than foreign hostility, the state news agency IRNA reported. “I have no serious concern about plots by the United States or others, because their hostility is obvious,” he said. “But I am deeply worried about false divisions and efforts to blacken everything inside the country.”
Hardline lawmakers have opened impeachment moves against four of his cabinet ministers this month in what critics say is an attempt to paralyze his government. Pezeshkian, a relative moderate, has urged cooperation to restore public trust and ease growing hardship under renewed sanctions.