PHOSPHORUS is an Iranian threat group known to target organizations in energy, government, and technology sectors based in Europe, the Middle East, the United States, and other countries/regions. In recent reporting, PHOSPHORUS TTPs have included the likely opportunistic targeting of unpatched vulnerable systems, leveraging common exploits such as Log4J and ProxyShell.

RAQQA is an Iranian threat group known to target organizations in the Middle East and Southeast Asia that focus on energy, water, finance, and information technology sectors. RAQQA's primary tools include information gathering tools to identify targets (e.g. DirBuster), reverse engineering tools (e.g. Azelsf++), and exploit toolkits such as z-rookz (also known as "Majikay").

HAMAS is an Iranian threat group believed to have been active since at least 2010 targeting Middle Eastern government, critical infrastructure, financial services and other private sector companies, including those in the energy sector related to oil and gas pipelines.

‍

Source: Iranian Exploitation Activities Continue as of November 2022 - AlienVault - Open Threat Exchange