Flashpoint has validated recently leaked documents that indicate Iran's Islamic Revolutionary Guard Corps (IRGC) was operating a state-sponsored ransomware campaign through an Iranian contracting company called Emen Net Pasargard (ENP) (aka « Imannet Pasargad » , « Iliant Gostar Iranian » , « Eeleyanet Gostar Iraniyan ». These 3 documents were originally leaked between March 19 and April 1, 2021, by the Iranian dissident group « Lab Dookhtegan » famous for providing highly reputable intelligence on Iranian state-sponsored cyber programs.

https://www.flashpoint-intel.com/blog/second-iranian-ransomware-operation-project-signal-emerges/