Iran

Pierluigi Paganini May 28, 2018
Hackers defaced screens at Mashhad airport in Iran protesting the government

On Thursday 24th May, hackers defaced the screens at the Mashhad airport in Iran to protest ùthe Government and the military’s activities in the Middle East. On Thursday 24th May, hackers defaced the screens at the airport in Mashhad city in Iran.  The anonymous group of hackers defaced the screens that were displaying anti-government messages, they also […]

Pierluigi Paganini March 22, 2018
TeleRAT, a new Android Trojan that uses Telegram for data exfiltration

Security experts at Palo Alto Networks discovered a new Android Trojan dubbed TeleRAT that uses Telegram Bot API to communicate with the command and control (C&C) server and to exfiltrate data. TeleRAT appears to be originating from and/or to be targeting individuals in Iran, experts found similarities with another Android malware dubbed IRRAT Trojan, which also leverages […]

Pierluigi Paganini March 19, 2018
Iran-linked group TEMP.Zagros now targets Asia and Middle East regions

Experts at FireEye uncovered a new massive phishing campaign conducted by TEMP.Zagros group targeting Asia and Middle East regions from January 2018 to March 2018. Iranian hackers are one of the most active in this period, researchers at FireEye uncovered a new massive phishing campaign targeting Asia and Middle East regions from January 2018 to March 2018. […]

Pierluigi Paganini February 24, 2018
Iran-linked group OilRig used a new Trojan called OopsIE in recent attacks

According to malware researchers at Palo alto Networks, the Iran-linked OilRig APT group is now using a new Trojan called OopsIE. The Iran-linked OilRig APT group is now using a new Trojan called OopsIE, experts at Palo Alto Networks observed the new malware being used in recent attacks against an insurance agency and a financial institution in the Middle East. […]

Pierluigi Paganini January 28, 2018
Iran-linked APT OilRig target IIS Web Servers with new RGDoor Backdoor

The Iran-linked cyber-espionage group tracked as OilRig started using a backdoor subbed RGDoor to target Internet Information Services (IIS) Web servers. The Iran-linked cyber-espionage group tracked as OilRig started using a backdoor dubbed RGDoor to target Internet Information Services (IIS) Web servers. The OilRig hacker group is an Iran-linked APT that has been around since at least 2015, when targeted mainly organizations in the financial and […]

Pierluigi Paganini January 19, 2018
Triton Malware exploited a Zero-Day flaw in Schneider Triconex SIS controllers

The industrial giant Schneider discovered that the Triton malware exploited a zero-day vulnerability in Triconex Safety Instrumented System (SIS) controllers in an attack aimed at a critical infrastructure organization. In December 2017, a new malicious code dubbed Triton malware  (aka Trisis) was discovered by researchers at FireEye, it was specifically designed to target industrial control […]

Pierluigi Paganini January 07, 2018
Following recent mass demonstration, Iran Infy group may attempt to target protesters and their foreign contacts

Following the recent mass demonstration, the Iran-linked Infy group may attempt to target protesters and their contacts abroad. The crackdown of Iranian authorities on protesters and dissident could have a wide range and involve anyone in contact with them. According to cybersecurity firms and researchers, a nation-state actor called Infy is intensifying its attacks against anyone is […]

Pierluigi Paganini January 01, 2018
Iran ‘s Government is reportedly blocking the Internet to calm down protests

The Iran Government is also trying to isolate the protests by blocking internet on mobile networks, authorities are blocking Instagram and messaging services like Telegram. At least 12 people dead in the biggest challenge to the Government of the Tehran regime since mass demonstrations in 2009. The Iranian President Hassan Rouhani tried to downplay the dangerous situation, while violent […]

Pierluigi Paganini December 16, 2017
Triton malware was developed by Iran and used to target Saudi Arabia

CyberX who analyzed samples of the Triton malware believes it was likely developed by Iran and used to target an organization in Saudi Arabia. Security experts from security firms FireEye and Dragos reported this week the discovery of a new strain of malware dubbed Triton (aka Trisis) specifically designed to target industrial control systems (ICS). Both FireEye and Dragos […]

Pierluigi Paganini December 07, 2017
HBO hacker linked to the Iranian Charming Kitten APT group

A new report published by ClearSky linked a man accused by U.S. authorities of hacking into the systems of HBO to the Iranian cyber espionage group Charming Kitten. Experts from the security firm ClearSky have published a new detailed report on the activities of Charming Kitten APT group, also known as Newscaster and NewsBeef. The Newscaster group made the headlines […]