Investigating links between Iranian hacktivists and nation state groups

Geopolitical Trigger

After Qasem Soleimani's 2020 killing, dozens of U.S. websites were defaced with his image and anti-U.S. rhetoric. The U.S. later indicted Iranian teen Behzad Mohammadzadeh and Palestinian accomplice Marwan Abusallam.

Why Investigate Hacktivists

SEC Alliance's speaker used basic OSINT to test rumored links between indicted defacers and Tehran. Hacktivists often overlap with cybercrime tooling nation-states reuse for cover.

OSINT Trail

Starting from indictment usernames and Zone-H defacement archives, she matched handles like mrbehzad and marijuana07, including phonetic Arabic spelling variants. Archived GitHub repos exposed spam bots, scanners, and Discord links tied to Abusallam.

Findings and Limits

Behzad's Zone-H profile showed nearly 2,000 submissions. Social accounts were often private or dead ends, but the investigation mapped hacktivist infrastructure beyond low-skill defacements.