Pro-Iranian Nasir Security Is Targeting Energy Companies in the Gulf

Key Takeaways

• Nasir Security targets Middle East energy supply chain vendors.
• Attacks use BEC spear‑phishing and compromised cloud storage.
• Stolen documents include contracts, risk assessments, schematics.
• Data theft enables planning of physical attacks on oil infrastructure.
• Activity expected to rise with Iran’s cyber‑warfare strategy.

Summary

Resecurity has identified a nascent Iran‑linked cybercriminal group, Nasir Security, that is systematically targeting energy firms across the Gulf through supply‑chain compromises. The attackers focus on engineering, construction and safety vendors, stealing authentic contracts, risk‑assessment reports and schematics via business‑email‑compromise and cloud‑storage exfiltration. These stolen documents give the group granular insight to plan physical sabotage of oil fields and pipelines. Resecurity warns that activity, which paused in late 2025, is likely to resume and may be accompanied by false‑flag and psy‑ops campaigns.

Pulse Analysis

The emergence of Nasir Security underscores a broader shift in Iran’s cyber strategy, where state‑aligned actors move beyond traditional espionage to directly undermine economic lifelines. By infiltrating third‑party vendors that support oil and gas operators, the group exploits the inherent trust and connectivity of the energy supply chain. This approach mirrors tactics seen in previous regional campaigns, but the focus on authentic engineering and safety documents provides a richer intelligence set that can inform precise, high‑impact sabotage.

Technical analysis reveals a blend of classic business‑email‑compromise (BEC) lures, spear‑phishing with impersonated executives, and exploitation of publicly exposed applications to gain footholds. Once inside, actors harvest data from insecure cloud repositories, exfiltrating files that detail pipeline layouts, equipment specifications, and contractual obligations. Such information not only fuels disinformation efforts but also equips adversaries with the blueprints needed for coordinated physical attacks, potentially causing prolonged outages and costly repairs given the long lead times for specialized oil‑field equipment.

Looking ahead, analysts anticipate an escalation in both cyber and kinetic operations as Iran leverages cyberspace to demonstrate resolve amid ongoing conflict. The likelihood of false‑flag operations and psychological‑operations (psy‑ops) campaigns will increase, complicating attribution and response efforts for regional stakeholders. Companies operating in the Gulf should prioritize hardened email security, zero‑trust access controls for cloud services, and rigorous vetting of supply‑chain partners to mitigate the risk of becoming a conduit for broader geopolitical aggression.