Iran-sponsored threat group behind false flag social engineering campaign Cybersecurity May 7, 2026 The state-linked actor has been masquerading as a criminal ransomware group in attacks targeting U.S. organizations.