Threat Actor Characterization
Milad Mansuri
ID: c81f42761d1b53a2d875a33ddfb8cdb764758Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
2833df69906a2ea5d05283ca4f837bd432121 | CyberAv3ngers | Iran | member-of | Cybercrime |
|
d9d80d03cfe271e7a52c9a8768b0178c82621 | Islamic Revolutionary Guard Corps Cyber | Iran | member-of | Cybercrime |
|
1f5fd004e2bc3bbfb90dfe63b705316398875 | Mr Soul | Iran | ally-of | Cybercrime |
|
c10849ad18c502e24aa0deb1e72ea8d450069 | Soldiers of Solomon | Iran | related | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Milad Mansuri is a publicly named senior official of Iran's IRGC-CEC. Public reporting ties him to the command environment behind CyberAv3ngers-linked critical infrastructure activity, but does not provide strong evidence of him as an individually documented hands-on operator.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1078.001 | Default Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1491.001 | Internal Defacement | TA0040 |
|
| T1565.001 | Stored Data Manipulation | TA0040 |
|
| T1595 | Active Scanning | TA0043 |
|
Milad Mansuri — IRGC-CEC senior official linked to CyberAv3ngers
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: State cyber official / command-enablement profile - Origin: Iran
Author: iQBlack CTI Team
Executive Summary
Milad Mansuri is publicly identified by the U.S. Department of the Treasury as a senior official of the Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). Public U.S. government material does not provide a detailed biography, formal job title, or individually attributed intrusion history for Mansuri. The strongest defensible assessment is therefore institutional rather than personal: he is part of the command environment publicly linked to malicious cyber operations against critical infrastructure through the CyberAv3ngers persona.
The operational significance of Mansuri comes from his location inside the IRGC-CEC ecosystem during the period when CyberAv3ngers activity became a major public concern, particularly the compromise of internet-exposed Unitronics PLCs and later reporting on broader OT/ICS and IoT targeting. Public government and vendor reporting tie that ecosystem to weak/default credential abuse, public intimidation and defacement, and, in later reporting, the IOCONTROL malware family targeting OT/IoT/Linux-based platforms.
IOC Appendix — Milad Mansuri
Scope & Caveats. Milad Mansuri is an individual official profile, not a malware family or independently documented intrusion set. Accordingly, this appendix emphasizes cluster-level hard indicators and operationally useful observables from the IRGC-CEC / CyberAv3ngers ecosystem rather than pretending a personalized Mansuri-only IOC corpus exists. Items below should be treated as ecosystem-relevant and used with confidence labels and context.