iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ashiyane Forum grew from a section of an Iranian security team’s website into a prominent hub for hacking discussion and tool sharing, then went offline in 2018. The available evidence documents its growth and shutdown, but does not establish an official reason for its closure or show that all forum members worked for the Iranian state.
From security team website to standalone forum
Ashiyane Digital Security Team was founded in 2002. According to Recorded Future’s 2019 account, the group initially presented its purpose as security education and vulnerability identification. Behrooz Kamalian was the team’s founder and CEO.
The forum reportedly began in early 2003 as a section of ashiyane.com. In 2006 it expanded to ashiyane.org, with areas for general questions, tools, website defacement, training and news. That change gave the forum room to serve a wider community than a single team’s website section.
Recorded Future reports that it observed posts from more than 20,000 forum members. That figure describes the report’s observed member set; it is not a count of unique active users at the time the site closed.
#1 Best Overall
What Ashiyane did—and what its role does not prove
Recorded Future reviewed 12 years of threads and found that much of the forum’s content centered on web exploitation. It assessed, with medium confidence, that Ashiyane Forum and the team that created it were important places for Iranian contractors to identify talent and exchange successful offensive tools and tactics. This is an analytical judgment about the forum’s function, not proof that every member was a contractor or state operative.
The evidence for connections to state-linked activity comes in different forms and has different limits:
Rank #2
- Recorded Future’s assessment: The report points to reported links between the security contractor and the Islamic Revolutionary Guard Corps (IRGC), and to a forum user handle also found in APT33 malware. Those indicators may be relevant to the report’s assessment, but a shared handle does not verify a person’s identity or establish that forum participants generally acted for the state.
- Earlier public accounts: A 2012 U.S. House hearing record says Ashiyane claimed responsibility for defacing thousands of websites and describes alleged IRGC ties, while acknowledging uncertainty about the extent of government coordination. Article 19’s 2016 report describes both training and educational activity and hacking activity; it also notes that some claims came from former members and that it could not verify a reported claim about Kamalian’s role with Iran’s FATA Police.
- Criminal charges: The U.S. Department of Justice announced in March 2016 that seven Iranian individuals employed by two Iran-based companies had been indicted over an alleged DDoS campaign against U.S. financial institutions. The release said two defendants were associated with Ashiyane Digital Security Team. It described allegations, not findings that the defendants were guilty, and it did not establish that Ashiyane Forum directed the campaign.
The distinction matters: an association with the team is not the same as proof of a person’s conduct, and an allegation about individuals is not proof of the forum’s institutional role in a specific operation. The DOJ release states: “An indictment is merely an accusation and all defendants are presumed innocent unless proven guilty in a court of law.”
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Key events in Ashiyane’s history
| Date | Event reported by the cited source |
|---|---|
| 2002 | Recorded Future says Ashiyane Digital Security Team was founded, initially describing its goal as security education and vulnerability identification. |
| Early 2003 | Recorded Future’s archived-page research places the start of Ashiyane Forum as a section of ashiyane.com. |
| 2006 | The forum expanded to ashiyane.org and included sections for discussion, tools, defacement, training and news. |
| 2009 | Recorded Future reports that a government directive targeted hacking sites after the Green Movement and that Ashiyane was among forums that remained. The report’s explanation for why it remained is speculation attributed to the hacker community, not an established fact. |
| 2011 | Recorded Future says the U.S. Treasury listed Kamalian for sanctions. |
| March 12, 2018 | According to Recorded Future, the team’s official channel announced that a court had ordered it to suspend activities until further notice. No reason was given in the announcement as described by the report. |
| August 5, 2018 | Recorded Future’s data indicates that the forum went offline. |
| By early November 2018 | Recorded Future reports that Kamalian was out of prison. It found no public explanation from him for the forum shutdown. |
Why did Ashiyane Forum shut down?
The public account described by Recorded Future establishes two separate events: the team announced a court-ordered suspension in March 2018, and the forum went offline in August. The announcement did not state a reason, and the sources consulted by Recorded Future did not resolve one.
Recorded Future says sources in Iran associated the shutdown with gambling operations, which could carry serious legal consequences. The report also notes that Ashiyane had previously been linked to gambling in a 2013 database leak. But gambling as the cause of the 2018 shutdown remains an unconfirmed theory, not an official explanation. Recorded Future could not independently verify a statistic about gambling sites cited in connection with that theory. Rumors at the time also included hacking or a forced closure.
Where did members go after the forum went offline?
Recorded Future examined 18,060 users it classified as active before the shutdown. It found exact username matches for 4% on other Persian-, Arabic-, Russian- or English-language forums, then focused its comparison on VBIran.ir and Persian Tools.
| Forum compared in Recorded Future’s 2019 report | Exact Ashiyane username matches | How the report characterized the forum |
|---|---|---|
| VBIran.ir | 237 | More discussion- and tutorial-oriented, covering hacking and software development. |
| Persian Tools | 85 | A broader mix of sales, hacking, electronics, Iran-related topics and other subjects, with hosting and web-design services. The matches appeared during or after the shutdown period. |
These counts indicate possible movement between communities, not verified migration by named individuals. Usernames can be reused; Recorded Future says common handles produced false positives and reports little overlap between the two forums. The report describes those sites as observed in 2019, not as a verified account of their present-day status. Its figures are source-reported; the reviewed material does not provide an independent census of Ashiyane membership or migration.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to read the evidence
Recorded Future’s 2019 Insikt Group report is the fullest account among the sources discussed here. Its scope note says it drew on the company’s platform, direct forum interaction, open-source research and interviews with a former Iranian hacker who claimed firsthand knowledge. The evidentiary weight varies: archived pages and observed activity support a different kind of claim from an interview allegation or an analytical assessment.
For that reason, Ashiyane is best understood as a significant forum and security team with reported connections to Iran’s broader cyber ecosystem—not as evidence that every participant was state-directed, or that the forum itself commanded every attack associated with an individual or group.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
