Ravin Academy is recruiting the largest cohort of cybersecurity students in its history at a moment of open conflict between the US and Iran, when the number of cyberattacks on US infrastructure attributed to Iran is already growing. The US Department of the Treasury's sanctions decision regarding Ravin states that the academy previously supplied recruits to Iran's Ministry of Intelligence and Security (MOIS), while other authoritative analysts believe that Ravin likely trained Iranian hacking groups responsible for attacks on the critical infrastructure of states opposed to the Iranian government. All of this together indicates that, after training, Ravin's students may swell the ranks of Iran's cyber-military units.
An analysis based on monitoring the open communication channels used by Ravin and its students makes it possible to assess the scale and reach of the academy's latest activity.
Ravin Academy recruits the largest cohort of students in its history
Ravin Academy, an Iranian company engaged in training cybersecurity specialists, offers hundreds of young Iranians up to a year of free cybersecurity training. The program, called the Nam-Avar Educational Scholarship Plan, is open to Iranian citizens aged 17 to 30 from all regions of the country, and enrollment is carried out based on the results of a nationwide competitive exam. Ravin announced from 600 to 1,200 available places, making this program the largest publicly announced by the academy since it began operating in 2020. Ravin Academy claims the course is provided free of charge thanks to the sponsorship of unnamed Iranian corporations.
Ravin Academy explains that the Nam-Avar program is free for all participants, and the requirements and obligations of students are set out in detail in messages on Bale — an Iranian messaging platform.
Four years ago, the US Department of the Treasury imposed sanctions on Ravin Academy and two of its co-founders — Seyed Mojtaba Mostafavi and Farzin Karimi. US authorities stated that the academy trains students in cybersecurity and hacking methods, and also recruits employees for MOIS among its students. Other analysts concluded that Ravin Academy likely trained hackers linked to the Iranian group MuddyWater, also known as Yellow Nix, which is responsible for cyberattacks on government bodies, financial institutions and medical organizations across the Middle East and North Africa (MENA) region. Analysis shows that Ravin previously advertised programs that allowed participants to complete mandatory military service while simultaneously working as cybersecurity specialists at a private company serving providers of Iran's critical infrastructure. Against the backdrop of the ongoing conflict between the US and Iran, the available information suggests that graduates of Ravin Academy may in the future use the skills they have acquired as part of cyber warfare.
Interest in the scholarship is growing in Ravin's discussion channels
The monthly number of messages in three Telegram channels controlled by Ravin Academy from March 2020 to July 2026. The frequency of the academy's posts did not change after sanctions were imposed on it in October 2022.
In the academy's official channel, the volume of posts remained stable after the sanctions were imposed and in the following years. However, activity in the exam support group and the unofficial student group — where participants discuss everything from training courses to internet memes — rose sharply after the announcement of the Nam-Avar program and the subsequent entrance exam.
The monthly number of messages in three Telegram channels controlled by Ravin Academy from March 2020 to July 2026. The frequency of the academy's posts did not change after sanctions were imposed on it in October 2022. In the academy's official channel, the volume of posts remained stable after the sanctions were imposed and in the following years. However, activity in the exam support group and the unofficial student group — where participants discuss everything from training courses to internet memes — rose sharply after the announcement of the Nam-Avar program and the subsequent entrance exam.
Previously, Ravin advertised employment programs through which participants could fulfill Iran's mandatory military service requirements. The program announced in May 2024 involved joint training and subsequent employment at Behin Rahkar — an Iranian provider of cybersecurity solutions that sells products and services to companies in the critical-infrastructure sector, including the oil and gas industry, water supply, telecommunications and other areas. Under the advertised scheme, Ravin was to train candidates in the Security Operations Center (SOC) Tier 1 course, after which Behin Rahkar would hire them. The offer included work on what the advertising called some of Iran's largest security projects, long-term employment, and the opportunity for suitable candidates to complete mandatory military service while continuing to work at the company and receiving a full salary.
The route from training to military service advertised in 2024. The Ravin and Behin Rahkar scheme, ending in employment that, according to the advertising, counted as completion of mandatory military service while retaining a full salary.
For the current Nam-Avar scholarship program, Ravin did not advertise a similar military-service scheme, nor did it name specific companies sponsoring the program or planning to hire its graduates. The 2024 program shows how the academy previously directed its participants to work on protecting Iran's critical infrastructure as an alternative to mandatory military service.
Ravin's technology olympiad and Iranian state entities
Ravin's public ties with Iranian state organizations continue to this day. Recently, the academy has been promoting its third Technology Olympiad — a cybersecurity competition for students that begins on August 29, 2026. Ravin's advertising materials state that the olympiad will include five separate competitions, one of which is devoted to industrial control systems and offers teams the chance to analyze «real or simulated industrial infrastructure» and document «possible attack scenarios».
Ravin also reports that the olympiad will be held with the participation of two Iranian state organizations:
- The Passive Defense Organization (PDO): the PDO is an Iranian state entity responsible for protecting critical infrastructure. On July 26, 2010, the EU imposed sanctions on it for participating in the selection of sites and the construction of facilities related to Iran's nuclear program, including the uranium enrichment facility at Fordo.
- The ICT Research Institute: the ICT Research Institute is the main research division of Iran's Ministry of Information and Communications Technology. The institute serves as an advisory body and analytical center for the ministry and has separate staff and resources for work in the field of cybersecurity.
Ravin Academy's partnership with the PDO and the ICT Research Institute for the upcoming olympiad indicates that the ties between the academy and the Iranian government remain close.
Ravin teaches using materials from Western companies
The Nam-Avar curriculum gives a detailed picture of the technical foundation that Ravin intends to provide to the new cohort of students. The first stage, running from July to December 2026, includes Network+, LPIC1, Python Basics, MCSA and CEH v13. Four of these five courses are based on training materials published by major Western cybersecurity companies and international certification organizations — and this is a recurring practice for Ravin.
The academy openly reports that its curricula use materials from Western sources, emphasizing their lower cost compared to the originals and translating part of the training materials into Persian. Cybersecurity companies themselves publish educational materials, seeking to help raise the level of cyber defense worldwide. The specific companies in this case are not named, but are notified of the use of their materials directly; Ravin Academy's borrowing of these materials does not in itself indicate any violations or irresponsibility on the part of the companies concerned.
What the catalog of 203 courses includes
Blockchain is an unusual topic for a standard cybersecurity course. However, MOIS-linked groups such as MuddyWater are known to have used smart-contract code to carry out cyberattacks. More broadly, groups linked to the Islamic Revolutionary Guard Corps (IRGC) used cryptocurrencies to evade sanctions, which was previously noted by the US Department of the Treasury in its sanctions decision against Zedcex Exchange. The inclusion of blockchain development courses in Ravin's program indicates that the academy may be teaching students similar capabilities.
The offensive security program includes classes on the use of Cobalt Strike, Mimikatz, Windows kernel exploitation, malware development in C and C#, as well as bypassing antiviruses and endpoint detection and response (EDR) systems. The defensive direction includes threat hunting, building security information and event management (SIEM) systems and developing detection mechanisms.
Ravin cooperates with sanctioned Russian Positive Technologies
Simultaneously with expanding its internal training activity, Ravin established openly advertised relations with Positive Technologies — a Russian cybersecurity company that the US sanctioned for supporting and recruiting employees for Russia's Federal Security Service (FSB).
These relations publicly manifested in three stages over six months. In December 2023, Ravin held a joint webinar with Positive Technologies specialists titled «Detecting invisible attacks in the network». Ravin's advertising indicated that the target audience of the event included Iranian government bodies.
In April 2024, representatives of the two companies spoke together at GISEC Global in Dubai, occupying Hall 7, booth C55. In its Persian-language post about the event, Ravin called Positive Technologies «شریک تجاری خودش» — «its business partner».
Two months later, a Ravin instructor traveled to Moscow and spoke at Positive Technologies' main cybersecurity conference. Ravin later publicly reported on this appearance.
Why this matters for cybersecurity specialists
Ravin Academy is recruiting the largest cohort of students in its history, cooperating with a sanctioned Russian partner, and training participants in skills that directly strengthen Iran's cyber capabilities — all of this is happening during a period of conflict between Iran and the US. At the same time, in many cases the academy uses training materials created by well-known Western cybersecurity solution providers.
The materials published by Ravin Academy make it possible to get an idea of its activity. In particular, the course catalog shows what capabilities Iran's emerging cyber army is mastering, and this concerns both offensive and defensive skills. The context around Ravin Academy indicates that its graduates may direct these capabilities against the US, so it is important for cybersecurity specialists in both the private and public sectors to understand exactly what skills they are acquiring.
