IC Technology & Cyber — 2026-08-26

US Sanctions Six Iranian MOIS Cyber Operatives After UK Power Plant Shutdown

BLUFWashington's decision to fold cyber retaliation into its broader Iran economic campaign means future MOIS infrastructure intrusions will escalate sanctions pressure rather than prompt a separate cyber response track.

The Treasury Department on Monday sanctioned six Iranian nationals it linked to a hacking team operating within Iran's Ministry of Intelligence and Security, including Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh, Mohammad Reza Kadkhoda'i and Mojtaba Ghal'eh-Kuhi, four of whom were indicted last week for breaching employee email accounts at the Department of Labor, the Federal Energy Regulatory Commission and multiple UN organizations 12. Treasury said the group has conducted cyberattacks and financially motivated theft on behalf of the MOIS since 2023, targeting energy, defense, healthcare, IT and financial-sector networks and compromising multiple US local, state and federal government offices in summer 2024 12. The sanctions follow disclosure that Iranian hackers shut down a small UK power plant for four days without affecting the wider grid or causing outages, according to the Telegraph as cited by The Record 2. Treasury Secretary Scott Bessent framed the action as part of a broader "whole-of-government" economic campaign against Iran tied to reopening the Strait of Hormuz 123.

Analysis
The pairing of Treasury sanctions with the UK power plant intrusion signals that Washington is treating physical infrastructure disruption, not just data theft, as the threshold for economic retaliation against MOIS-linked actors. Naming the six operatives publicly aims to raise the personal cost of continued operations for Tehran's contractor-style hacking teams, even absent extradition prospects. The four-day UK outage without grid-wide effects indicates Iranian operators can reach operational technology environments but have not yet demonstrated the sophistication to cause cascading physical damage. Framing the action as part of a Hormuz-linked economic campaign ties cyber enforcement to broader sanctions leverage. Further OT intrusions could draw additional Treasury designations rather than a separate cyber-specific response track.

3 sources

Treasury Launches Unprecedented Campaign Against Iranian Regime on Economic D-Day - U.S. Department of the Treasury
US sanctions Iranian cyber actors as UK discloses power plant attack - The Record
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches - The Hacker News