Loading story…
An Iran-linked surveillance operation tracked as TAG-182 has been distributing the MarkiRAT remote access trojan through trojanized software posing as VPN and media-player applications, including YEPlayer and Pis2rayVPN. The malware is designed to monitor victims and exfiltrate data through spoofed domains and PHP-based command-and-control endpoints, using techniques such as BITSAdmin for payload delivery and persistence via a fake svehost.exe process made to resemble svchost.exe.
The activity has been assessed as part of a broader Iranian domestic monitoring campaign that intensified after wartime internet restrictions and the partial restoration of connectivity on May 26, 2026. The operation aligns with Iran’s internal security posture and is likely tied to state repression efforts involving organizations such as the IRGC, Basij Cyber Council, FATA, and MOIS, with defenders provided indicators including command-and-control infrastructure, SHA-256 hashes, and detection content such as YARA and Sigma rules.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Recorded Future published research assessing TAG-182 as an Iran-linked cyber-surveillance operation using MarkiRAT disguised as software such as YEPlayer and Pis2rayVPN. The report disclosed technical details including delivery methods, persistence behavior, command-and-control infrastructure, hashes, and detection rules.
The report states that Iran partially restored internet access on May 26, 2026, after wartime restrictions. It frames subsequent surveillance activity in the context of the government's post-conflict internal security posture.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 54 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026
Researchers and industry defenders linked the Iranian threat cluster tracked as **TA453**, **ITG18**, **Charming Kitten**, and **Phosphorus** to sustained espionage operations targeting people of intelligence interest, including Middle East policy experts, senior academics, journalists, and individuals aligned with Iran’s Reformist movement. Proofpoint said the actor used **Operation SpoofedScholars**, in which operators posed as UK academics, built trust through extended email exchanges, and then sent “registration” links to credential-harvesting pages hosted on a compromised **SOAS** website to steal email credentials across multiple identity providers. IBM Security X-Force reported the same broader cluster also deployed a custom Android surveillance backdoor, **LittleLooter**, disguised as `WhatsApp.apk`, and successfully compromised roughly 20 victims between August 2020 and May 2021, exfiltrating about **120 GB** of data with **Telegram** content prominently represented. The malware supported audio and video recording, message and contact theft, call and location collection, browser-history access, and remote file and connectivity management, while investigators also found repeated operational security failures, including open servers and exposed victim archives; Microsoft separately highlighted legal and technical steps to protect customers from nation-state hacking tied to Iranian operators.
Aug 15, 2026
Researchers at **Acronis** reported a cyberespionage campaign—tracked as **CrescentHarvest**—targeting Farsi-speaking individuals sympathetic to Iran’s anti-government protests, including potential dissidents and supporters abroad. The operation uses social engineering lures packaged as malicious archive files containing authentic-looking protest media and a Farsi-language report that portrays the protests positively and repeats protest slogans, likely exploiting heightened demand for information amid Iranian internet blackouts. The archive includes files disguised as a video and an image that deploy a previously undocumented malware family dubbed **CRESCENTHARVEST**, assessed to function as both a **remote access trojan** and **information stealer**. Reported capabilities include command execution, keystroke logging, and theft of sensitive data such as saved credentials, browser history/cookies, and **Telegram** account information, along with checks for installed antivirus to modulate behavior. While no specific APT group was named, Acronis assessed the code, infrastructure, and victimology as consistent with an **Iran-aligned** actor; reporting also noted operational quirks (e.g., unused C2 endpoints and buggy User-Agent handling) that may indicate lower maturity or a rapidly assembled campaign tied to the protest-driven geopolitical moment.
Jun 29, 2026