Adversary Intelligence — 2026-09-07

US Offers 10 Million Dollar Reward for IRGC Cyber Operations Chief Directing Attacks on Critical Infrastructure

BLUFNaming Yaryab as the individual directing CyberAv3ngers and related groups tightens attribution pressure on IRGC-CEC leadership but does nothing to blunt ongoing targeting of US critical infrastructure.

The State Department's Rewards for Justice program on September 3 offered up to $10 million for information on Amir Yaryab, identified as a senior IRGC official who leads the Cyber-Electronic Command's Cyber Operations Command 1. The department said Yaryab directs IRGC-CEC components Shahid Hemmat and Shahid Shushtari, which it says have conducted cyber and cyber-enabled information operations against critical infrastructure sectors including defense, news, shipping, travel, energy, and financial and telecommunications systems in the US, Europe and the Middle East 12. The department further stated Yaryab oversees IRGC-CEC-affiliated groups CyberAv3ngers, Dadeh Afzar Arman and Mehrsam Andisheh Saz Nik, which it says have used malware against civilian infrastructure worldwide 23. The State Department issued a separate $10 million reward for CyberAv3ngers hackers last year over 2023-2024 water utility attacks 2.

Analysis
The reward attaches personal liability to a named commander rather than anonymous hacking collectives, converting a diffuse threat picture into a point of accountability and signaling Washington now holds sufficient attribution confidence to individualize the CyberAv3ngers, Dadeh Afzar Arman, and Mehrsam Andisheh Saz Nik campaigns under a single IRGC-CEC chain of command. That attribution rests on a single primary government notice reproduced near-verbatim across wire and outlet reporting, giving broad surface corroboration but limited independent verification. Prior reporting framed this activity institutionally through CISA and FBI warnings; the State Department has now tied it to a named individual with a price on his identification, which could complicate operational security for the affiliated groups even as their infrastructure targeting continues unabated. The bounty may function primarily as a public deterrence signal rather than a genuine intelligence-collection tool given Yaryab's presumed insulation within Iran, and water, energy, and finance-sector operators gain no immediate protection from the designation, leaving current defensive posture unchanged regardless of whether the reward yields actionable leads.
4 sources
  1. Amir Yaryab - Rewards for Justice (U.S. Department of State)
  2. US offers $10 million for info on Iranian allegedly behind cyberattacks on critical infrastructure - The Record
  3. Who is Amir Yaryab, IRGC's cyber commander in US crosshairs? - Al-Monitor
  4. US offers up to $10 million for information on IRGC cyber commander - Iran International

View in full brief →

UNCLASSIFIED // OPEN SOURCE