Arvin Club is a hacktivist-leaning crimeware group known for data theft and public leaks via TOR and Telegram rather than ransomware encryption.
Arvin Club is a crimeware group with hacktivist leanings that, despite its naming, relies on data theft and public leaks via TOR sites and Telegram rather than deploying file-encrypting ransomware. They target government, education, and banking sectors globally, including Iranian government entities. As their primary TTPs focus on data exfiltration and exposure, defenders must prioritize monitoring for data exfiltration indicators, anomalous network connections to TOR/Telegram infrastructure, and implementing strict access controls to sensitive repositories.
Arvin Club is a threat actor with hacktivist leanings that first appeared in May 2021, primarily publishing stolen data via a TOR site and Telegram rather than deploying file-encrypting ransomware, targeting government, education, and banking sectors globally including Iranian government entities.
Arvin Club's primary TTPs are data theft and public exposure of stolen data via TOR sites and Telegram channels, rather than file encryption.
Defenders must prioritize monitoring for data exfiltration indicators, anomalous network connections to TOR/Telegram infrastructure, and implementing strict access controls to sensitive repositories.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.