Threats Tagged 'dchspy'

TAG-182, an Iran-nexus threat cluster, is conducting surveillance operations targeting Iranian citizens both domestically and abroad using MarkiRAT malware. The group distributes fake Android applications masquerading as VPN services and media players through social media platforms, particularly Instagram. Following Iran's partial internet restoration in May 2026 after an 88-day shutdown, these surveillance activities have intensified as Iranian security apparatus seeks to monitor perceived dissidents and anti-government activists. MarkiRAT samples demonstrate tradecraft overlaps with previously documented Ferocious Kitten operations, including use of Background Intelligent Transfer Service (BITS). The group operates infrastructure across multiple autonomous systems, utilizing domains with naming conventions mimicking legitimate services like Microsoft, Google, and Facebook.

MuddyWater, an Iranian cyber espionage group linked to Iran's Ministry of Intelligence and Security, is deploying DCHSpy, an Android surveillanceware, amid the Israel-Iran conflict. DCHSpy is distributed via malicious VPN apps promoted on Telegram channels and is capable of extensive data collection including WhatsApp data, contacts, SMS, files, location, call logs, audio recordings, and photos. Recent variants have enhanced capabilities for exfiltrating data from specific files and WhatsApp. The malware's targeting appears to leverage StarLink-related lures, exploiting Iran's internet outages. DCHSpy shares infrastructure with SandStrike, another Android malware targeting Bahá’í practitioners. This threat poses significant espionage risks to individuals in conflict zones and those using Android devices in targeted regions.

MediumMalwareIranIsraelUnited States+7#dchspy#conflict#israel