KrebsOnSecurity has learned that the email address used by a cybercriminal actor who offered to sell the stolen ICRC data also was used to register multiple domain names the FBI says are tied to a sprawling media influence operation originating from Iran.
https://krebsonsecurity.com/2022/02/red-cross-hack-linked-to-iranian-influence-operation/