IRLeaks is a cybercriminal entity that emerged in July 2023, primarily specializing in data breaches and ransomware-style operations against Iranian organizations. The group gained prominence through a Telegram channel used to publicize their leaks and communicate with victims. Assessed with high confidence to be of Iranian origin, IRLeaks operates as a financially motivated collective rather than a state-sponsored or politically aligned group, distinguishing itself from hacktivist entities by its clear emphasis on extortion over ideological disruption. Their defining characteristic is the consistent targeting of critical Iranian infrastructure, including financial, insurance, and consumer services sectors, with the primary motivation being financial gain through the exfiltration of large volumes of sensitive data and subsequent ransom demands.