Iran's Soft-War for Internet Dominance
summary
Research maps multiple Iranian intrusion campaigns that target journalists, human-rights defenders, diaspora networks and even separatist militants using real social engineering and bespoke tools rather than commodity kits. Evidence includes a fake university site spreading Gambar malware (C code, SOAP exfil, in-memory keylogging, minimal disk traces), droppers that load LuminosityLink RAT via PowerShell, use of Metasploit, and a campaign that enumerates 15–18 million Telegram IDs by abusing the API and SMS flows; sinkholing reclaimed DGA domains and collected ~200–300 infected callbacks, showing the operations are effective and evolving.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:01Context and Methodology
- 3:02Iran's Cyber Landscape
- 5:09State Cyber Activities
- 7:43Malware Trends
- 10:26Gambar Malware Analysis
- 14:28Operations of Cleaver
- 19:29SEMA Actor Analysis
- 26:09Rocket Kitten Techniques
- 29:57Telegram Abuse
- 37:03Infy Group Analysis
- 44:57DGA and Mitigation
- 47:15Future Research and QA
related talks
20mYour Persistent Friend: The Untold History of Iran’s Effectiveness in Using...
12mTheir Own Little War: Iran Adopts Disruptive Ransomware
08mIran's Decade of Soft War: Dissidents, Trolls, and Khamenei
21mMossad.com: How Iran is Using Fake Job Sites and Movie Studios to Catch Moles
56mCybersecurity & Privacy From The Global Lens
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
40mThe Last Remaining Cover for Action
26mThe Secret Life of Sandworms