ESET says Iran’s own internet restrictions degraded Iran’s hackers, and the hackers are back

ESET published its APT Activity Report for April–September 2026 on 28 October. Middle East-aligned activity increased over the previous period, the firm wrote, “driven mainly by the return of several established Iran-aligned groups” whose earlier decline was “most likely because internet restrictions imposed by the Iranian regime hindered their own ability to operate effectively” — a named vendor attributing a drop in Iranian offensive capability to Iranian domestic censorship. An OilRig subgroup ESET calls FilthyFeline, along with MuddyWater, resumed operations mostly against entities in Israel, with a smaller number of US companies affected; FilthyFeline also appears to have taken over access to a cellular data service provider in Uzbekistan previously compromised by BladedFeline, another OilRig subgroup. ESET separately documented Arid Viper, a Hamas-affiliated actor, operating against what it assesses to be the Palestinian Authority’s Ministry of Foreign Affairs and Expatriates or an affiliated body — intra-Palestinian espionage, not Israel-directed work. On artificial intelligence, ESET’s statement said researchers “identified several cases of APT groups using AI and large language models – LLMs — at various stages of their operations”; the illustrative case is Russia-aligned UAC-0099 planting a decoy nuclear weapon request in a script comment to trip LLM-based security guardrails, which is manipulation of defensive AI rather than AI-written malware.

A day later, DomainTools Investigations published research on a persona cluster — MrHex, @Mr8ex, MrDarkRoot and Darku3er — running leak sites and Telegram channels. The domain mrhex.sbs was registered on 31 July 2026, carries the second title “Organizational Discloser,” and “attempts to emulate a Wikileaks style of hack and leak reporting.” DomainTools assesses the operation as “an evolving hybrid between a criminal data market system, a hack-and-leak operation, and an emerging OT-access actor in service to Iran, affiliated with Handala and by proxy, Iran’s MOIS” — the firm’s own assessment, not a government attribution. It then draws the line this desk cares about: MrHex “should be considered a credible data-theft, leak-distribution, and unauthorized-access threat whose demonstrated access is narrower than its propaganda claims,” with credible evidence of at least one industrial-control-system compromise. One. Steven Stover of the 780th Military Intelligence Brigade, summarising the work on LinkedIn, noted that Persian-language reporting has described MrHex as an Iranian actor targeting entities in Israel and the US, Kurdish opposition entities, and organisations deemed enemies of Iran.

Assessment: Two findings sit uneasily together and both are worth holding. ESET’s censorship claim cuts against the assumption that a throttled internet is a purely defensive posture: it taxes the state’s own operators. DomainTools' sentence about demonstrated access being narrower than propaganda claims is the standard every reader should apply to the week’s cable video as well — leak brands are optimised for publication volume, not for intrusion depth, and an ICS claim is a marketing asset before it is a capability. The MOIS link runs through one vendor and the phrase “by proxy.” The Arid Viper finding will be the least covered and is the most politically consequential: Hamas-affiliated collection against the Palestinian Authority’s foreign ministry is a Ramallah story, not a Tel Aviv one.