Sanctioned Ravin Academy Training Biggest Ever Class of Future Iranian Cyber Fighters, Partners with Russian Firm as US-Iran War Continues

Key takeaways

• Iranian cybersecurity training firm Ravin Academy announced in May 2026 that it is recruiting between 600 and 1,200 Iranians aged 17 to 30 for a free, year-long cybersecurity scholarship — the largest program it has publicly advertised.
• The US Treasury sanctioned Ravin Academy and its founders in October 2022 for assisting Iran’s Ministry of Intelligence and Security (MOIS) with cyber activities and for recruiting on MOIS’ behalf from its student body.
• Since late 2023, Ravin has publicly promoted a relationship with Positive Technologies, a Russian cybersecurity company the US sanctioned in 2021 over its links to Russian intelligence services.
• A previous Ravin program offered graduates employment and paid compulsory military service at Behin Rahkar, an Iranian security vendor that markets products and services to critical infrastructure firms. More recently, Ravin has promoted an upcoming technology olympiad in partnership with two Iranian state agencies, one of which – the Passive Defense Organization – is sanctioned in the EU.
• Ravin publishes enough of its curriculum to provide an unusually detailed view of the skills it teaches its prospective workforce, including both offensive and defensive security techniques, much of it lifted from educational material published by Western cybersecurity firms.

Ravin Academy is recruiting its largest cyber training class yet, at a time of open conflict between the United States and Iran, with cyberattacks on US infrastructure attributed to Iran already increasing. The US Treasury’s sanctions designation for Ravin says that the academy has previously supplied recruits to Iran’s Ministry of Intelligence and Security (MOIS), while other reputable analysts say Ravin has likely provided training to Iranian hacker groups responsible for cyberattacks on critical infrastructure in states opposed to the Iranian government. All of this taken together indicates that Ravin students may join Iran’s cyberwarfare efforts following training.

TRM analysis, which drew on monitoring of open source communication channels used by Ravin and its students, sheds light on the size and scope of Ravin’s latest activity.

{{horizontal-line}}

Ravin Academy is recruiting its largest class yet

Ravin Academy, an Iranian cybersecurity training firm, is offering up to a year of free cybersecurity training to hundreds of young Iranians. The program, called the Nam-Avar Educational Scholarship Plan, is open to Iranians aged 17 to 30 from across the country, with admission granted through a competitive national examination. Ravin has advertised between 600 and 1,200 places, making it the largest program the academy has publicly announced since it began operating in 2020. Ravin Academy states that the course is offered for free thanks to sponsorships from unnamed Iranian corporations.

Four years ago, the US Treasury sanctioned Ravin Academy, along with its two co-founders, Seyed Mojtaba Mostafavi and Farzin Karimi, stating that the academy trains students in cybersecurity and hacking, and recruits for MOIS from its student body. Other analysts have assessed that Ravin Academy likely trained hackers associated with Iranian threat actor MuddyWater (also known as Yellow Nix), which has been responsible for cyberattacks on governments, financial institutions, and healthcare organizations across the Middle East and North Africa (MENA) region. TRM’s analysis finds that Ravin has previously advertised programs allowing trainees to complete their compulsory military service by taking cybersecurity jobs with a private sector firm servicing Iranian critical infrastructure providers. As conflict between the US and Iran continues, the information available suggests that Ravin Academy trainees may be deployed in future cyberwarfare efforts.

Interest in the scholarship is rising on Ravin’s discussion channels

Analysis of activity in Ravin-affiliated discussion channels shows growing interest in the program.

Ravin’s official announcement channel maintained consistent message volume following the academy’s sanctions designation and in the years following. Message volume in its exam support group and unofficial student discussion group, however — where trainees share everything from thoughts on courses to internet memes — has spiked following the announcement of the Nam-Avar program and its subsequent entrance examination.

How an earlier Ravin program offered a route to employment and military service

Ravin has previously advertised job placements through which trainees can fulfill Iran’s military service requirements. Announced in May 2024, that program entailed joint training and employment with Behin Rahkar, an Iranian cybersecurity vendor that markets cybersecurity products and services, with customers across critical infrastructure providers in oil and gas, water, telecommunications, and more. Under the advertised arrangement, Ravin would train candidates through its security operations center (SOC) Tier 1 course before Behin Rahkar employed them. The offer included work on what the advertisement described as some of Iran’s largest security projects, a long-term employment commitment, and the option for eligible recruits to complete compulsory military service while working at the company on a full salary.

Ravin has not advertised an equivalent military-service arrangement for the current Nam-Avar scholarship, nor has it identified specific companies sponsoring the program or expected to employ graduates. The 2024 program shows how the academy has previously placed trainees in jobs protecting Iran’s critical infrastructure as an alternative to compulsory military service.

The Technology Olympiad: Ravin’s upcoming student competition, in partnership with Iran’s Passive Defense Organization and ICT Research Institute

Ravin’s public relationship with Iranian state organizations continues today. Recently, the academy has been promoting its third Technology Olympiad, a cybersecurity competition for students that begins on August 29, 2026. Ravin promotional materials share that the olympiad will involve five distinct competitions, one of which focuses on industrial control systems inviting teams to analyze "real or simulated industrial infrastructure" and document "possible attack scenarios." Ravin also states that the olympiad will be held with participation from two Iranian state agencies: The Passive Defense Organization (PDO): The PDO is an Iranian state entity tasked with safeguarding critical infrastructure. The EU sanctioned the PDO on July 26, 2010 for its role in site selection and construction of infrastructure related to Iran’s nuclear program, such as the Fordow uranium enrichment site. The ICT Research Institute: The ICT Research Institute is the primary research arm of Iran’s Ministry of Information and Communications Technology (ICT). The institute functions as an advisory body and think tank within the ministry, with dedicated staff and resources for cybersecurity. Ravin Academy’s partnership with the PDO and ICT Research Institute for its upcoming olympiad suggests that ties between the academy and the Iranian government remain strong.

Ravin’s public curriculum takes material from Western cybersecurity firms

Nam-Avar’s curriculum provides a detailed view of the technical baseline Ravin intends to give its new cohort. The first stage, running from July through December 2026, includes Network+, LPIC1, Python Basics, MCSA, and CEH v13. Four of those five courses are lifted from educational material published by large Western cybersecurity firms and international certification bodies – a recurring pattern for Ravin. The academy openly promotes the fact that its syllabi include material from Western sources, highlighting the lifted material’s affordability compared to originals and translating some coursework into Persian. Cybersecurity firms openly publish educational materials in order to promote better cyber defense worldwide. While we’ve chosen not to name specific vendors here and instead notify them privately, Ravin Academy’s appropriation of their materials does not suggest any wrongdoing or irresponsibility by those firms. However, it points to a broader shift: The removal of expertise as a barrier to entry for cybercrime. Tools like ransomware-as-a-service kits and, more recently, the spread of AI, have lowered the skill needed to launch an attack. Ravin Academy’s curriculum shows that the same principle applies to the training of future cyber attackers.

What the 203-course catalog covers

TRM identified 203 courses and webinars advertised by Ravin since July 2020. Based on their primary advertised purpose, 53 were classified as offensive security, 39 as defensive, and six as both. The remaining 105 sit outside those categories but include malware analysis, hardware engineering, and blockchain development. Blockchain is an unusual topic for a standard cybersecurity course; but MOIS-linked threat actors like MuddyWater have been known to use smart contract code for cyberattacks. More generally, groups linked to the Islamic Revolutionary Guard Corps (IRGC) have used cryptocurrency to circumvent sanctions, as Treasury stated in its sanctions designation against Zedcex Exchange. Ravin’s inclusion of blockchain development courses indicates it may be training students in similar capabilities. The offensive catalog includes training involving Cobalt Strike, mimikatz, Windows kernel exploitation, malware development in C and C#, and antivirus and endpoint detection and response (EDR) evasion. Defensive courses include threat hunting, security information and event management (SIEM) construction, and detection engineering.

Ravin has partnered with a sanctioned Russian cybersecurity firm

While expanding its domestic training operation, Ravin has developed an openly advertised relationship with Positive Technologies, a Russian cybersecurity company the United States sanctioned for supporting and recruiting on behalf of Russia’s Federal Security Service (FSB). The relationship appeared publicly in three stages over six months. In December 2023, Ravin hosted a joint webinar with Positive Technologies specialists titled “Detecting Invisible Attacks in the Network.” Ravin’s advertising said the intended audience included Iranian government bodies.

In April 2024, representatives of the two companies appeared together at GISEC Global in Dubai, sharing Hall 7, booth C55. In its Persian-language coverage of the event, Ravin described Positive Technologies as «شریک تجاری خودش» — “its own business partner.”

Two months later, a Ravin instructor traveled to Moscow and presented at Positive Technologies’ flagship cybersecurity conference. Ravin later publicized the appearance.

What this means for cyber defenders and security vendors

Ravin Academy is recruiting its largest class yet, teaming up with a sanctioned Russian counterpart, and training students in skills that feed directly into Iran’s cyber capabilities at a time of conflict between Iran and the United States — in many cases using course material drawn from prominent Western cybersecurity vendors to do so. Materials published by Ravin Academy shed light on its operations. In particular, its course catalog also provides insight into the capabilities Iran’s aspiring cyber workforce is training in, both offensive and defensive. The context around Ravin Academy indicates that its trainees may turn those capabilities on the United States, so it’s important for cybersecurity professionals in both the private and public sectors to understand them. TRM has documented similar patterns across Iran’s crypto ecosystem, from OFAC’s designation of Iran’s domestic crypto exchanges to Shelbit’s role as a USD 6.3 billion settlement layer and Iran’s use of crypto to fund conflict and evade sanctions.

{{horizontal-line}}

Frequently asked questions (FAQs)

1. What is Ravin Academy?

Ravin Academy is a Tehran-based cybersecurity training company operating since 2020, selling courses in penetration testing, threat hunting and security operations. The US Treasury designated the academy and its two co-founders in October 2022, saying it trains people in cybersecurity and hacking and recruits from among its trainees for Iran's Ministry of Intelligence and Security. The EU, UK, Canada, Ukraine and Monaco have also listed it. It has continued advertising courses without interruption since and is now recruiting the largest program in its history.

2. Is Ravin Academy still sanctioned?

Yes. The US Treasury designated Ravin Academy on October 26, 2022 under Executive Order 13606, and it remains on the Specially Designated Nationals list. The European Union listed the academy in January 2023, Canada in March 2023, and the United Kingdom in 2023. Ukraine and Monaco have also listed it. Ravin’s two co-founders, Seyed Mojtaba Mostafavi and Farzin Karimi, are designated separately.

3. What is Positive Technologies?

Positive Technologies is a Russian cybersecurity company the US Treasury designated in April 2021, saying it supported Russian government clients, including the Federal Security Service (FSB), and that conventions it hosted were used as recruiting events for the FSB and the Main Intelligence Directorate (GRU). Ravin documented its relationship with the company publicly — a joint webinar, a shared exhibition stand where it called Positive Technologies its business partner, and an instructor’s appearance at Positive Hack Days in Moscow — after the United States had sanctioned both companies.

4. What is the Passive Defense Organization?

The Passive Defense Organization (PDO) is an Iranian state entity tasked with safeguarding critical infrastructure, and is currently sanctioned by the EU. The EU's designation highlights the PDO's responsibility for protecting strategic nuclear facilities, including the Fordow uranium enrichment site. EU documentation identifies Brigadier General Gholam-Reza Jalali, formerly of the IRGC, as its president.

5. What is the ICT Research Institute?

The ICT Research Institute is the primary research arm of Iran's Ministry of Information and Communications Technology (ICT). It has acted as an advisory body and think tank for the ministry for 52 years, and had dedicated staffing and laboratories for information security and related topics.

6. Does Ravin Academy have an onchain transaction history?

TRM analysis found no onchain activity associated with Ravin Academy. Our monitoring of Ravin’s open-source communication channels found no posted cryptocurreny addresses. The academy does teach blockchain and applied cryptography, which is unusual for a commercial security catalog, but there is no evidence yet of Ravin Academy itself using cryptocurrency. For TRM’s reporting on Iran’s use of crypto infrastructure, see our analysis of the Zedcex commercial ecosystem.