Executive Summary
Cyber Isnaad Front, a persona operated by the IRGC-affiliated Aria Sepehr Ayandehsazan (ASA), has transitioned from hack-and-leak influence operations to destructive attacks against Israeli industrial targets. During 2025 and 2026, the group has utilized 'ceasefire' periods to target unglamorous but vital sectors including food production, energy, and telecommunications.
The actor employs a dual-track attack strategy: a Go-based Remote Access Toolkit (GRAT) is used for IT environment persistence and data wiping, while simultaneous manual manipulation of industrial control systems (ICS) is used for physical sabotage. In a recent refrigeration plant attack, the group bypassed malware for OT destruction, instead using technical knowledge of CO2 refrigeration to reprogram setpoints and force hardware failure through mechanical over-pressurization.
This activity represents a sophisticated convergence of IT and OT expertise. The use of front personas allows Iran to maintain deniability while inflicting tangible physical damage on civilian infrastructure during periods of low-intensity kinetic conflict.