Sanctioned Iranian Ravin Academy Launches Massive Hacking Recruitment Drive

Ravin Academy, a sanctioned Iranian cybersecurity training firm, has launched its largest recruitment drive to date, seeking between 600 and 1,200 Iranians aged 17 to 30 for a free yearlong scholarship. The program trains students in hacking and cybersecurity, including the analysis of industrial infrastructure to develop cyberattack scenarios. According to the United States Department of the Treasury, trainees are recruited for the Iranian Ministry of Intelligence.

Despite being sanctioned by the U.S. in 2022 to deter its progress, the academy continues to expand. It has collaborated with the sanctioned Russian firm Positive Technologies and utilizes proprietary materials from international bodies and companies, such as the SANS Institute and Microsoft Corp., to replace English-language courses. The academy has also previously offered job placements to help students fulfill military service requirements.

TRM Labs identified the recruitment drive and warned that participants may be integrated into cyberwarfare efforts. This expansion coincides with warnings from the Federal Bureau of Investigations regarding cyberattacks on water and wastewater companies across seven U.S. states, although no direct link between those specific attacks and Ravin Academy has been established.