Iran MOIS-directed cyber group (Mesri, Ghal'eh-Kuhi, Blagh, Kahzadian) - OFAC-listed crypto addresses
- Scam type: Hack
- Chain: Bitcoin
- Reported: 2026-10-14
- Last updated: 2026-10-16
On 2026-08-24 OFAC (Operation Economic Outcast) designated members of a malicious cyber group directed by Iran's Ministry of Intelligence and Security (MOIS). Treasury says the group, led since at least summer 2023 by Mojtaba Ghal'eh-Kuhi and Behzad Mesri, compromised and exfiltrated data from U.S. critical-infrastructure companies (energy, defense, healthcare, IT, finance) and, in summer 2024, multiple local, state and federal government offices; Arman Kahzadian focused on digital-asset heists (took control of a wallet holding >$30,000 in BTC in summer 2023). Behzad Mesri ('Skote Vahshat')…
Other addresses in this report: bc1qf6zxs4lkp9umh6hf087mh70w0ymcyt8cunp58r, bc1qr2pwmvkpq5tc5um2g9uh34yyu6wepwx89rts70, bc1q4ktvxxhhvf8qhs9qkdsm9arcxfmmeex6rl7n50, 0x4060cbf80734193f521a3cc6fd4e985df2825279, 0x56de1527136f76a809e5b14ded6103eecd072ba7, 0xbd3276f265b83b5e828c05f46cde9d10a1521a24, 0xf1c4c44d2dcbcfa704349e3b57628dbd8404e597, TXR4FDAZZLDSvuRxveW9aBMybbaS12WWHk, TP3kVtnFgDSoSqzw178nLJtGWNjrbKNgB6, 1GXeCkFQq7SYo6B7wdLAPkkri6NFTFB7No, 0x1b8579cf6ab12ea6b74ac5fa41f3829a3cb61e6e, 1JGPiQGK78xTxAVoxA1MjK3Z15M84Rj6BL, 0xeb507efa9ee692a4c774ad1de9f3cb26fc459da3, 0xef85a6fafa5942a964dc618e94e230881d29ce2a, 12aNKp2iDKuhEde2YfPdd4DFGenRUTKupL, 0x252a8bd2319d8a555b872990601221b3a2053bce, 0x1cab8177ace78b1b6b1c393371f4f2dcae40cbeb, 0x6fac4d18c912343bf86fa7049364dd4e424ab9c0, 0xa40cfbfc8534ffc84e20a7d8bbc3729b26a35f6f, 0x7f03679b56d8772530efa516b58bb83d4829e881 and 9 more