IRWatch

IRWatch (irwatch.org) is an OSINT platform focused on monitoring and reporting on Iran-linked activities, infrastructure, and entities across cybersecurity and geopolitical domains. It aggregates intelligence about Iranian state-sponsored threat actors, sanctioned entities, infrastructure used in Iranian cyber operations, and related geopolitical developments.

For OSINT investigators working on Iran-related threat intelligence, sanctions compliance, or national security investigations, IRWatch provides a focused intelligence feed that covers a domain often underrepresented in general-purpose threat intelligence platforms.

Iranian cyber threat actors — including groups tracked as APT33, APT34, APT39, Charming Kitten, and others — represent persistent threats to government, defense, energy, and financial sector targets globally. IRWatch's threat actor tracking helps analysts understand the current activity, tooling, and infrastructure associated with these groups.

For sanctions compliance investigations, IRWatch provides intelligence about sanctioned Iranian entities and their digital infrastructure — domains, IP ranges, email patterns, and operational behavior — that helps compliance teams identify potential sanctions exposure in financial or business relationships.

The platform's infrastructure monitoring provides indicators of compromise (IOCs) associated with Iranian operations: malicious domains, C2 infrastructure, phishing campaigns, and malware families. These indicators can be directly incorporated into network defense rules or used to contextualize incidents involving Iranian-origin infrastructure.

Geopolitical reporting on IRWatch covers developments in Iranian cyber and information operations, providing the strategic context that technical indicators alone cannot provide. Understanding campaign motivations, targeting patterns, and geopolitical triggers helps analysts anticipate and interpret technical findings.

For attribution investigations, IRWatch's aggregated intelligence about Iranian threat actor infrastructure, tooling, and operational patterns provides a reference baseline for comparing technical indicators found in an incident against known Iranian capabilities.

Always verify IRWatch intelligence against additional authoritative sources including CISA advisories, DOJ indictments, and vendor threat intelligence reports. Document the specific indicators sourced from IRWatch with retrieval dates.