MalwarePublished 1 Jul 2026Updated 31 Jul 2026

Iran-Nexus Disseminates MarkiRAT Surveillance Tool

Source AlienVault OTX General

Description

TAG-182, an Iran-nexus threat cluster, is conducting surveillance operations targeting Iranian citizens both domestically and abroad using MarkiRAT malware. The group distributes fake Android applications masquerading as VPN services and media players through social media platforms, particularly Instagram. Following Iran's partial internet restoration in May 2026 after an 88-day shutdown, these surveillance activities have intensified as Iranian security apparatus seeks to monitor perceived dissidents and anti-government activists. MarkiRAT samples demonstrate tradecraft overlaps with previously documented Ferocious Kitten operations, including use of Background Intelligent Transfer Service (BITS). The group operates infrastructure across multiple autonomous systems, utilizing domains with naming conventions mimicking legitimate services like Microsoft, Google, and Facebook.

Impact

The MarkiRAT malware enables surveillance of Iranian citizens, potentially compromising their privacy and security by monitoring perceived dissidents and anti-government activists. The use of fake applications and trusted-looking domains increases the likelihood of successful infection. The campaign's targeting of individuals domestically and abroad suggests a broad scope of surveillance operations with significant privacy implications for affected users.

Defensive guidance

Defenders should be aware of the distribution of fake Android applications posing as VPNs and media players, particularly on social media platforms like Instagram. Users should avoid installing unverified applications and verify app sources carefully. Network defenders should monitor for suspicious domains mimicking legitimate services and consider blocking or scrutinizing traffic to such domains. Since this is a malware campaign rather than a software vulnerability, standard patching does not apply.

Summary

The Iran-nexus threat cluster TAG-182 disseminates MarkiRAT malware primarily through fake Android applications masquerading as VPNs and media players distributed on social media platforms, notably Instagram. This campaign targets Iranian citizens both inside Iran and abroad, intensifying after Iran's partial internet restoration in May 2026. MarkiRAT demonstrates operational similarities with the Ferocious Kitten group, including leveraging Background Intelligent Transfer Service (BITS) for persistence or data transfer. The adversary uses infrastructure spanning multiple autonomous systems and employs deceptive domain naming conventions that imitate well-known technology companies to evade detection and increase trust.

Indicators of compromise

Domains 53

yemplayer.site
min.comi-site.website
microsoft.comi-site.website
comesignt.website
min.come-site.website
google.comisignin.online
accountes.google.comesignt.website
accounts.google.comisignin.online
microsoft.come-site.website
comi-site.website

URLs 1

https://vip.yeplayer.store/files/YEPlayer.rar

IP addresses 5

46.30.191.123
89.144.145.237
45.86.162.197
46.30.191.105
89.144.145.239

Hashes 26

400eb6a94810323a1fc5f8ab31c682fe765aaec2cc61b37c31d719c7e45c9a6c
8a7f5c8533df9e51b2da7cc2aeb52d8787418e4915577cc9288be1e46d1945c6
07d1db998e4dacc6777f1c854b3ab605
b56a18df4daf038785891f33c3e89489
d151ad777bcf1b3205273ab732c0fad6
d66de5d6dbcb6f460ae6240de8b7aab0
db6bc0e947acba379e540349f74fc6ee
1c841649189a46806084b189f50300e36c423163
3fe1fcc2a21e4bab144da57ea6d0f13ddb9819e0
40513398ae248c87f46b13b7f9f303e05d018472

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 31 Jul 2026, 19:23 UTC

MITRE ATT&CK techniques15 from threat tags

Technical details