US sanctions Iranian entities that gathered targeting intelligence on American forces and allies

The State Department has designated two Iran-based entities accused of collecting intelligence used to target US forces and partner militaries across the Middle East, in the opening move of a sweeping new economic campaign against Tehran.

The two entities were sanctioned alongside seven members of Iran’s defence leadership whom Washington accuses of procuring weapons and directing attacks on US service personnel and regional partners. The action was announced on Monday as part of “Operation Economic Outcast”, a whole-of-government pressure campaign launched at President Trump’s direction.

The two entities are the Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC), the Guards’ cyber and electronic warfare arm, and DadeNegar Startup Studio, an IRGC-affiliated front company that operated under civilian technology branding.

According to the State Department, the entities “gathered intelligence for targeting US forces and allies”, and the officials designated alongside them were responsible for enabling Iranian military strikes against American and partner forces across the region. The designations were made under Executive Order 13846, which authorises sanctions with respect to Iran, and Executive Order 13949, which targets Iran’s conventional arms activities.

DadeNegar was designated by the Treasury on 30 July under counter-terrorism authority Executive Order 13224 after it found that the company ran a publicly accessible website soliciting the locations of American and Israeli military equipment in the Middle East and, in coordination with the IRGC, received strike requests for US targets. The operation allowed targeting data to be crowdsourced at near-zero cost, without the satellites, signals platforms or human agents required for conventional intelligence collection. Monday’s State Department action layers a second set of authorities on top of that designation and formally ties the company to the conventional arms sanctions framework.

The IRGC-CEC is the more significant addition. It is the Guards’ principal organisation for offensive cyber operations, signals intelligence and electronic warfare. The Treasury has previously sanctioned contractors and individuals conducting spear-phishing and malware campaigns against US companies and government agencies on its behalf. Designating the command itself for targeting intelligence signals that Washington assesses it to have been providing the Guards’ missile and drone units with locational data on US and partner forces during the current war.

The measures block any property the designated parties hold within US jurisdiction and expose foreign financial institutions that knowingly transact with them to secondary sanctions.

Targeting cycle, not just trigger-pullers

The choice of targets is notable. Rather than confining itself to the missile and drone units that have struck US and allied positions since the war began on 28 February, Washington has targeted the intelligence infrastructure that makes those strikes possible: the organisations that locate, profile and prioritise targets before a weapon is launched.

Sanctioning the collection layer of Iran’s targeting cycle signals that the United States regards intelligence support for attacks as equivalent, for sanctions purposes, to the attacks themselves. It also creates a legal basis for pursuing any third-country technology vendors, data providers or telecommunications operators found to have supplied those entities.

Part of a much wider package

The State Department action was one strand of a far larger operation unveiled by Treasury Secretary Scott Bessent, who described it as an “economic D-Day”. The Treasury issued five new sectoral sanctions determinations under Executive Order 13902, covering digital assets, technology, gold, aviation and shipping. They allow the United States to sanction any foreign person operating in those sectors of the Iranian economy, wherever they are located.

The Office of Foreign Assets Control also designated nearly 60 entities, individuals and vessels across the UAE, Hong Kong, China, Singapore, Switzerland and Europe. These include a procurement network supplying Malek Ashtar University of Technology and other Ministry of Defence and Armed Forces Logistics subordinates with laser optics, accelerometers and other missile-applicable components; a cyber group directed by the Ministry of Intelligence and Security that compromised US energy, defence, health care and financial companies; and a shadow-fleet network of brokers, bunkering providers and tankers moving Iranian crude to East Asia.

The Treasury also suspended several general licences that had allowed remittances to Iran and Iranian access to US academic and cultural institutions, and issued guidance on the sanctions risk of complying with Iranian demands on shipping in the Strait of Hormuz.

Bessent said the campaign’s objective was to sever every economic lifeline sustaining the regime “until Tehran stands alone”, and warned that teams from the Treasury, State and War Departments were engaging governments worldwide with defined timelines to shut down Iran-related activity. He declined to name the countries involved or set a public deadline.

The sanctions come nearly six months into the US-Israel war with Iran, with the conflict in what US officials have described as a “no war, no deal” limbo following the April ceasefire and the memorandum of understanding signed in Islamabad in June. Iran’s Supreme National Security Council chief Mohsen Rezaei warned over the weekend that support for US sanctions by other nations would be treated as an “act of war”, and that Iran would target alternative oil routes bypassing Hormuz.

US officials have indicated that expanded secondary sanctions are expected to be the primary instrument against Tehran at least until after the November midterm elections.