Investigating cyber threats and electronic activities of the Iranian regime.
29 posts
In my previous analyses of the Charming Kitten leak, I examined the organizational structure, target lists, financial infrastructure, and operational capabilities of Iran's APT35 hacking unit. The disclosures identified key personnel, front companies, and thousands of…
The cyber group "Banished Kitten," operating under the alias "Handala" and affiliated with the Ministry of Intelligence and Security of Iran (MOIS), has once again exposed its own clumsy…
A massive leak of internal documents has blown the cover off one of Iran's most active hacking groups. For years, the cybersecurity community tracked them as APT35, Charming Kitten, Fresh…
The fourth release of leaked documents from Iran's APT35 (Charming Kitten) operation exposes something previous leaks haven't: the complete financial backbone and infrastructure procurement…
Based on the intelligence assessments from multiple government agencies, Ravin Academy functions as a MOIS-directed recruitment and training front operating under commercial cover. Recent…
In my previous analysis of the Charming Kitten leak, I examined the unprecedented breach that exposed the inner workings of an Iranian state-sponsored hacking operation. The leak revealed…
In what appears to be one of the most significant breaches of an Iranian state-sponsored hacking operation to date, an anonymous source has published internal documents, employee…
The Islamic Republic is floating the idea of unblocking Telegram again, and if you believe this is about digital freedom, I have a bridge in Tehran to sell you. Elias Hazrati, head of…
Lab-Dookhtegan has been systematically targeting Iranian infrastructure for months now, and when they reached out about their latest operation, I knew it would be significant. This group…
Tonight, Iran International TV revealed the identity of one of the key figures behind the Handala hacking group that claimed responsibility for attacking the network's newsroom last month…
The Charming Kitten group has launched a new tactic for targeting Iranian activists. Instead of creating fake identities, they're now directly impersonating a senior Pentagon official. The…
They called themselves cybersecurity experts. They're actually Tehran's digital hit squad. Someone handed me the keys to the kingdom—gigabytes of data ripped from internal servers of…
What if the June 18, 2025 cyberattack on Iran's largest cryptocurrency exchange wasn't really about destroying $90 million in digital assets, but rather about exposing and disrupting a…