A Muddy, Advanced Persistent Teacher

16th November 2022

On 26th October 2022, the US Department of Treasury issued broad sanctions against Iranian entities including a cyber security company, Ravin Academy, and the two individuals that founded it “for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, the MOIS.”1 Ravin Academy and its founders have been known to the PwC Threat Intelligence team since early 2020 as having ties to several Iran-based threat actors including Yellow Nix (aka MuddyWater, MERCURY, TA450). We are publishing a portion of our private client reporting in light of the October 2022 indictments.

Cofounder Conundrums

Both Ravin Academy co-founders have been accused, by various leaks, of being linked to the Iran-based threat actor we track as Yellow Nix, along with Yellow Maero (a.k.a. APT34)3, which we assess with high probability operates at the behest of Iran’s Ministry of Intelligence (MOIS).4 On 12th January 2022, US Cyber Command attributed Yellow Nix to a “subordinate element” within MOIS, which supports the claims made as a part of these leaks.5 Additionally, both of the co-founders who were named in the October 2022 indictment, as well as other Ravin Academy employees, were found to have personal associations with Iranian individuals we have previously linked to Iran-based threat actors. These links are as follows:

Seyed Mojtaba Mostafavi (a.k.a. Mojtaba Mostafavi) has previously been accused of working for Yellow Maero at the behest of MOIS by the “Lab Dookhtegan” leaks.6 This allegation was made in September 2019, two months prior to the formation of Ravin Academy in November 2019.

According to Mostafavi’s LinkedIn resume, he previously held the position of Chief Strategy Officer (CSO) at ArvanCloud between 2015 - 2019. ArvanCloud is an Iran based VPS and cloud provider known to PwC analysts as being associated with/used by multiple Iran-based threat actors. We have additionally observed multiple Iran-based threat actors, Yellow Nix, Yellow Liderc and Yellow Dev 19, use operational relay box (ORB) IPs assigned to ArvanCloud.7 ,8 ArvanCloud has also been linked to the Iranian Government through a public-private partnership to support Iran’s National Information Network (NIN) (a.k.a. Iran Cloud).9 Opponents of this project have raised concerns that it effectively isolates Iranian infrastructure, and can support the government’s ability to control and limit access in the future.10 We identified multiple documents in open source which list MOIS as an NIN stakeholder.11

Figure 1 – Seyed Mojtaba Mostafavi’s LinkedIn profile

Farzin Karimi Mazlganchai (a.k.a. Farzin Karimi, Farzin Karimi Marzeghan Chai) is the second Ravin Academy co-founder. In 2019, a leak site named "Green Leakers” accused Farzin Karimi of being a leader of Yellow Nix operations.12 This allegation was made in April 2019, prior to the formation of Ravin Academy in November 2019. We consider some of the contents of the leak to be credible, specifically, a screenshot image of a purported Yellow Nix C2 panel showing IPs of current victims. At the time, the CEO of an Israeli security research company validated the Yellow Nix C2 panels as being legitimate.13 This suggests the "Green Leakers” operator was able to obtain access to infrastructure belonging to Yellow Nix and therefore it is possible that it was able to identify operators. Despite the inclusion of leak contents which are considered to be accurate, we are unable to confirm the allegation that Farzin Karimi is linked to Yellow Nix. PwC analysts are also aware of multiple instances where Farzin Karimi’s name and Twitter handle were embedded inside Yellow Nix samples. We assess that these samples were false flags, and were highly likely modified post-deployment in an attempt to link him to the threat actor.14

Figure 2 – Farzin Karimi’s LinkedIn profile

Conclusion

Although we did not directly link the company to the threat actor directly, we assess that Yellow Nix is highly likely familiar with Ravin Academy’s training materials and it is possible the set is comprised of a prior student/s. It is common in Iran-based threat actor ecosystems for individuals to move between companies engaged in offensive operations. We have also previously identified Iranian individuals who have been linked to multiple distinct Iran-based threat actors believed to act at the behest of different Iranian government sponsors.24 The multitude of professional and personal links involving the Ravin Academy founders demonstrate the complexity of attributing Iran-based threat actor activity, as the lines are often blurred as individuals move around what has shown to be a small, intertwined ecosystem.

The outcome of sanctions and public disclosure of Iran-based operations has had mixed impact on the associated threat actors; specifically, some threat actors continue with their operations despite the disclosures, while others have ceased to operate. At the time of this publication, it remains to be seen how the October 2022 sanctions will impact the named entities and associated threat actor activity.