As cited
Copy frozen at (site build).
threat intel
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
Insikt Group identified new infrastructure used by TAG-182, an Iran-linked threat cluster, to distribute MarkiRAT malware through fake Android applications disguised as VPNs and media tools targeting Iranians both domestically and abroad. The malware samples share technical similarities with previously attributed Ferocious Kitten activity, suggesting a possible operational connection. Following Iran's internet restoration in May 2026, surveillance operations using these tools are expected to intensify as Iranian authorities seek to monitor perceived dissidents.
Why it matters: Security teams protecting Iranian diaspora populations, civil society organizations, and anyone using Iranian-based services should identify and block MarkiRAT indicators of compromise and educate users to avoid fake VPN and media applications from untrusted sources, as this represents active state-sponsored surveillance targeting a specific geographic and political population.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
Insikt Group identified new infrastructure linked to TAG-182, an Iranian threat cluster distributing MarkiRAT malware through fake Android applications posing as VPNs and media tools to target Iranians both domestically and abroad. The malware shares tradecraft similarities with Ferocious Kitten, including use of the Background Intelligent Transfer Service (BITS), though organizational ties remain unconfirmed. Following Iran's internet restoration in May 2026, the group is likely intensifying surveillance operations against perceived dissidents and alleged foreign collaborators as part of broader Iranian government security objectives.
Why it matters: Organizations and individuals with Iranian users or diaspora communities face elevated risk of compromise through trojanized applications; security teams should distribute indicators of compromise and educate users on application verification while monitoring for MarkiRAT signatures in their environments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
Insikt Group identified new infrastructure linked to TAG-182, an Iranian threat cluster distributing MarkiRAT malware through fake Android applications posing as VPNs and media tools to target Iranians both domestically and abroad. The malware shares tradecraft similarities with Ferocious Kitten, including use of the Background Intelligent Transfer Service (BITS), though organizational ties remain unconfirmed. Following Iran's internet restoration in May 2026, the group is likely intensifying surveillance operations against perceived dissidents and alleged foreign collaborators as part of broader Iranian government security objectives.
Why it matters: Organizations and individuals with Iranian users or diaspora communities face elevated risk of compromise through trojanized applications; security teams should distribute indicators of compromise and educate users on application verification while monitoring for MarkiRAT signatures in their environments.
- Source published
- First seen by Cybersecurity Tracker