{
  "name": "Iran-Nexus Disseminates MarkiRAT Surveillance Tool",
  "slug": "iran-nexus-disseminates-markirat-surveillance-tool",
  "description": "TAG-182, an Iran-nexus threat cluster, is conducting surveillance operations targeting Iranian citizens both domestically and abroad using MarkiRAT malware. The group distributes fake Android applications masquerading as VPN services and media players through social media platforms, particularly Instagram. Following Iran's partial internet restoration in May 2026 after an 88-day shutdown, these surveillance activities have intensified as Iranian security apparatus seeks to monitor perceived dissidents and anti-government activists. MarkiRAT samples demonstrate tradecraft overlaps with previously documented Ferocious Kitten operations, including use of Background Intelligent Transfer Service (BITS). The group operates infrastructure across multiple autonomous systems, utilizing domains with naming conventions mimicking legitimate services like Microsoft, Google, and Facebook.",
  "published": "2026-07-01T16:58:02.320000+00:00",
  "created_at": "2026-07-02T07:14:41.043000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-02T07:14:41.043000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "bouldspy",
    "dchspy",
    "fake vpn",
    "farsi-speaking targets",
    "ferocious kitten",
    "furball",
    "iran",
    "irgc",
    "markirat",
    "surveillance",
    "tag-182"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "fea99bff-d9d7-4656-98ed-70c9976946f9",
        "name": "www.instagram.com-accounts.website"
      },
      {
        "id": "89661bd1-ea31-4b9f-85e5-a85975d04d1b",
        "name": "webmail.google.com-accounts.website"
      },
      {
        "id": "9955b76e-8b02-4e70-93ff-86cc1b32079f",
        "name": "webmail.instagram.com-accounts.website"
      },
      {
        "id": "5aa402f0-bf03-41c7-bb5e-83cd6a97ece4",
        "name": "https://vip.yeplayer.store/files/YEPlayer.rar"
      },
      {
        "id": "636be456-20f3-4722-84f2-178a821316a6",
        "name": "microsotf.come-site.website"
      },
      {
        "id": "ebaa5149-3f7d-4f12-a865-b18fde5a6eea",
        "name": "fa246327bed8fc5864827a8147b8b7aedb6246068259b8c97e82adb957315347"
      },
      {
        "id": "76f58040-1a45-4ada-9f69-39e1ad6b69b9",
        "name": "admin.google.com-accounts.website"
      },
      {
        "id": "388127d0-c2b9-4521-8091-2da869826363",
        "name": "accounts.google.comisignin.online"
      },
      {
        "id": "574af5ac-bb6e-40d9-a125-b44e1292630a",
        "name": "www.yemplayer.site"
      },
      {
        "id": "9c3d01a2-ecd0-45e6-b341-fe651c50dd94",
        "name": "vpn.pis2ray.online"
      },
      {
        "id": "aca76719-8ac5-4be8-add1-f7928d8c7328",
        "name": "f7bde19f9e085650378076dabac586dcdc256e743a57890000e71a7ebb43d8ee"
      },
      {
        "id": "4cb19554-6f1a-4202-bda3-7fcf6614fc91",
        "name": "89.144.145.239"
      },
      {
        "id": "f04421d5-8db5-4adf-8b57-7814b5868c7c",
        "name": "svpn.pis2ray.online"
      },
      {
        "id": "6ef9e365-1015-4658-a599-6194fbead30f",
        "name": "www.pis2ray.online"
      },
      {
        "id": "36d2009f-749a-42d2-9a86-051473c2e9f4",
        "name": "microsoft.pis2ray.online"
      },
      {
        "id": "07cc42d6-09b9-4dc7-b2ef-2a824a597b15",
        "name": "ns2.com-signin.site"
      },
      {
        "id": "d6d46cb0-544c-4c83-b789-42e88e00fc40",
        "name": "miga.comesignt.website"
      },
      {
        "id": "15837646-5702-497d-bdcf-216fdf970e2b",
        "name": "com-accounts.website"
      },
      {
        "id": "9ab29b3f-5aab-44e3-9735-086e6cc3df96",
        "name": "46.30.191.105"
      },
      {
        "id": "12501646-76e8-4568-a90e-424b77e9f6dd",
        "name": "webmail.facebook.com-accounts.website"
      },
      {
        "id": "3e048e6e-3f34-43b7-b804-62ce1ddf6581",
        "name": "ea755862ee81dd0d991b4afca42d8b82bb22a8f1d370bf3d28dbf2e44ab241dd"
      },
      {
        "id": "6e8d02c3-7a0d-4c93-83b3-890955c33495",
        "name": "www.facebook.com-accounts.website"
      },
      {
        "id": "8f6f4016-8641-46df-940d-5bf71c023b25",
        "name": "6c74d29903bc2cc17ec4afdb1a120d2060209b22830cee2b7005f5436e86f90e"
      },
      {
        "id": "90bdb98d-0d38-4edb-bed0-765fda690e58",
        "name": "66dcd98c6b310f4429890821e609d48cc6395a6be15ffe5a121ec68b7a8f7402"
      },
      {
        "id": "5ec8e52d-e8a3-47e5-bb8b-0917e6983a74",
        "name": "bb0c7ae4f12e5141480ee26f473636b07e836bb994ff3b2cfec93d4480da171b"
      },
      {
        "id": "df599375-a096-41de-a566-0211e167b6a9",
        "name": "89.144.145.237"
      },
      {
        "id": "891f89d2-415b-4df3-beb2-b70315e167e4",
        "name": "www.yeplayer.store"
      },
      {
        "id": "ef76be5b-f10e-480d-bf06-463d0d80f53c",
        "name": "46.30.191.123"
      },
      {
        "id": "5e136248-0e16-4e98-9002-24771eb9be8f",
        "name": "13440348516ccee839675f6ac908dd1724ce1d28f92af92fdc7938740d2b7ec5"
      },
      {
        "id": "91812c21-6c6e-4c24-bd3d-f972fa1271d0",
        "name": "www.google.com-accounts.website"
      },
      {
        "id": "80e3f374-2999-415c-9496-7cef839c244e",
        "name": "microsoft.comview.website"
      },
      {
        "id": "8a8584de-8896-4283-8988-609c9db44873",
        "name": "yemplayer.site"
      },
      {
        "id": "3f5847ef-1452-4a87-9182-0a759bcb6b12",
        "name": "microsoft.comesite.website"
      },
      {
        "id": "cae1caaf-18c8-449e-8ee1-9f608350880d",
        "name": "starvpn.pis2ray.online"
      },
      {
        "id": "64e9dc2c-119e-4a42-baa1-bfb9fdd298b3",
        "name": "come-signin.quest"
      },
      {
        "id": "a479f3c9-d75e-4076-89a0-01629943fd74",
        "name": "min.pis2ray.online"
      },
      {
        "id": "70bdc730-f756-49c8-8c45-53cf94d3e38e",
        "name": "comisignin.online"
      },
      {
        "id": "072487a0-a30b-473d-a92b-33c6fb59e37d",
        "name": "51a6686b8c5ec7c610637398f3de43589f4e9fcbe8bcc0245343c5454d3b91de"
      },
      {
        "id": "7a297bb2-96fd-4db1-9d51-d75c0c32f3a8",
        "name": "google.com-signin.site"
      },
      {
        "id": "ff046aa0-1960-4809-b2ab-9200a592bcb5",
        "name": "ns1.com-signin.site"
      },
      {
        "id": "eddeea04-b094-4c53-9def-779a6291c5b5",
        "name": "400eb6a94810323a1fc5f8ab31c682fe765aaec2cc61b37c31d719c7e45c9a6c"
      },
      {
        "id": "289d0340-fa1c-4a7f-9d59-8b89ee20bb30",
        "name": "microsoft.come-site.website"
      },
      {
        "id": "745121db-8350-4ec4-9879-55e624a6a7c4",
        "name": "sahar2ray.online"
      },
      {
        "id": "c604e78f-921c-466f-a95a-a4b75ae8a3ef",
        "name": "google.comisignin.online"
      },
      {
        "id": "7e6ad7f7-3d89-4605-b0ee-49a6eef01721",
        "name": "comestore.site"
      },
      {
        "id": "c64a1134-6da6-47aa-b3d0-e77fe5fc9721",
        "name": "8a7f5c8533df9e51b2da7cc2aeb52d8787418e4915577cc9288be1e46d1945c6"
      },
      {
        "id": "dfae0461-a7b6-47e2-97e5-a7789d11f455",
        "name": "min.comi-site.website"
      },
      {
        "id": "98a39365-badb-4b98-9b02-55b174fcbb3f",
        "name": "migavpn.store"
      },
      {
        "id": "def5dd4a-6324-4d53-8889-207a42b6fc94",
        "name": "comx-view.store"
      },
      {
        "id": "13fd7524-34e2-4d27-b42b-b342efaf3852",
        "name": "yeplayer.store"
      },
      {
        "id": "4e2a9523-2b22-4361-9bbf-efef602bff46",
        "name": "download.yeplayer.store"
      },
      {
        "id": "7dd35175-75c0-4682-88e2-e45ee1806094",
        "name": "microsoft.comi-site.website"
      },
      {
        "id": "1955d499-9507-4b6c-9e1f-0f522ede098d",
        "name": "vip.yeplayer.store"
      },
      {
        "id": "899e9abc-fbc5-4c96-af29-cfc40e144f95",
        "name": "microsotf.comi-site.website"
      },
      {
        "id": "e40aa522-7629-4703-8d10-922cb7dc4473",
        "name": "45.86.162.197"
      },
      {
        "id": "d6ab11c2-6c0f-425f-a1aa-3c24b2060070",
        "name": "comesignt.website"
      },
      {
        "id": "16bcdc17-4725-49b8-9404-7c12ff8e42d9",
        "name": "admin.instagram.com-accounts.website"
      },
      {
        "id": "d7535dd8-ecb8-4ff1-8b62-95fd6e600d86",
        "name": "c.pis2ray.online"
      },
      {
        "id": "9a6366a3-f5fd-42d7-b387-bd9a9db64a47",
        "name": "min.comview.website"
      },
      {
        "id": "ee5109ae-ac8d-4aaa-af33-aa7e8f170e15",
        "name": "cc59bf019af195dcec4394ffd7a8e23c080f4e02b12dcb7c04fb1da6671922a1"
      },
      {
        "id": "425e478a-6ff3-40b8-8330-d42fba101aa7",
        "name": "pis2ray.online"
      },
      {
        "id": "069bfbe8-383a-40a5-963f-36b6a1301d39",
        "name": "tools.sahar2ray.online"
      },
      {
        "id": "093b2a42-809d-4eef-b98b-f3a1928c7416",
        "name": "host.comview.website"
      },
      {
        "id": "c476094d-150e-4cf2-8f65-b899f0593d8c",
        "name": "google.com-accounts.website"
      },
      {
        "id": "56dd22d3-6d5c-4139-8e3a-b690fe8fb662",
        "name": "3b172281f65ceaee280ae810edb6fd39a1ecd25649f929f246c0405df94f4c89"
      },
      {
        "id": "7ffc01f3-a413-4188-b62b-10db729f9ddf",
        "name": "prx.pis2ray.online"
      },
      {
        "id": "e28874ae-3c66-4578-bd40-7e79417f19e8",
        "name": "a4f1b79e96a7d016de1991a64506792018de99eac5df00f7cabe26ef41b2bd81"
      },
      {
        "id": "8d64285c-639e-4b17-bce8-748f147bcfe4",
        "name": "min.come-site.website"
      },
      {
        "id": "ac29c7f3-bbde-40e5-bdca-6997c69589b9",
        "name": "webmail.com-accounts.website"
      },
      {
        "id": "5b839935-d6e2-48b5-95bb-97308ea897aa",
        "name": "accountes.google.comesignt.website"
      },
      {
        "id": "f1b2a046-733d-4ef7-840e-bc71396b10c9",
        "name": "comi-site.website"
      },
      {
        "id": "07b4f2f7-e868-43b9-9150-22d08d1093a2",
        "name": "orbitx.site"
      }
    ],
    "intrusion_sets": [
      {
        "id": "ecef2806-3be8-4db2-a135-509aedea7b94",
        "name": "TAG-182",
        "slug": "tag-182"
      }
    ],
    "attack_patterns": [
      {
        "id": "5882a135-5b7e-4caf-93e8-80f7df41cef2",
        "name": "T1564.001"
      },
      {
        "id": "6c54bb5e-b90c-478e-b1fb-705daf1869b3",
        "name": "T1197"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "d19f56ca-5ce8-4bd1-af90-7d83e394470c",
        "name": "T1583.001"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "e0688dec-a386-4264-99e9-246d746e9829",
        "name": "BouldSpy",
        "slug": "bouldspy"
      },
      {
        "id": "f2f08272-482f-4f58-94b0-c7d2b2913db7",
        "name": "FurBall",
        "slug": "furball"
      },
      {
        "id": "c00584ab-826a-463d-9897-1223250a36d6",
        "name": "DCHSpy",
        "slug": "dchspy"
      },
      {
        "id": "239dbb07-9e2c-4132-80d5-99078f6819fe",
        "name": "MarkiRAT - S0652",
        "slug": "markirat-s0652"
      }
    ],
    "observables": [
      {
        "id": "788781ce-1ea9-40a7-83ca-9a4ff03408df",
        "name": "migavpn.store"
      },
      {
        "id": "a9b9b8a3-6c23-4a2e-a531-51e64cb74060",
        "name": "come-signin.quest"
      },
      {
        "id": "9dc4dfa5-fdaf-4063-84cd-33ed66a3aafa",
        "name": "sahar2ray.online"
      },
      {
        "id": "4830d663-2e68-480b-8b94-8783f6499bf1",
        "name": "orbitx.site"
      },
      {
        "id": "01bbd564-b430-42a1-af10-2b1632c12cef",
        "name": "com-accounts.website"
      },
      {
        "id": "60367517-1f86-48e3-9883-05c9654b9b4b",
        "name": "yemplayer.site"
      },
      {
        "id": "687a0505-f62f-49ec-b3d8-e9b11f17f5b8",
        "name": "yeplayer.store"
      },
      {
        "id": "530c1d64-1b10-4c8a-ba4b-8fa4d07c066f",
        "name": "pis2ray.online"
      },
      {
        "id": "82518acd-7010-4564-a8b1-c5a9fa552568",
        "name": "comisignin.online"
      },
      {
        "id": "3da486b9-945b-49ab-acbd-55e938084c10",
        "name": "comestore.site"
      },
      {
        "id": "9c9bdf2d-81a3-4042-a4cb-fe1aae06cffd",
        "name": "comi-site.website"
      },
      {
        "id": "354323b2-cd37-4aa0-b672-c56cbb67846a",
        "name": "comx-view.store"
      },
      {
        "id": "6145d605-51dc-4666-8345-ab7f826b80bb",
        "name": "comesignt.website"
      },
      {
        "id": "9101b7b0-7c99-462e-98b7-a815bda34866",
        "name": "www.facebook.com-accounts.website"
      },
      {
        "id": "1ae1a8a5-088e-420d-a0ec-0ce0be62596b",
        "name": "tools.sahar2ray.online"
      },
      {
        "id": "cf1372c5-5bd9-47fa-a3ad-200319048f41",
        "name": "webmail.instagram.com-accounts.website"
      },
      {
        "id": "5001a76c-598e-47a7-a9e6-2edd992defe9",
        "name": "svpn.pis2ray.online"
      },
      {
        "id": "01274670-4ef6-478a-82a5-a1b2303bc81d",
        "name": "download.yeplayer.store"
      },
      {
        "id": "d2340ada-e4b5-42b5-bebb-ed6e8b1ffde8",
        "name": "admin.instagram.com-accounts.website"
      },
      {
        "id": "9eb24453-af47-4f58-8cc3-6cd5fd7086c8",
        "name": "miga.comesignt.website"
      },
      {
        "id": "7812228c-29b2-409b-a0ae-8acb7409bad4",
        "name": "min.pis2ray.online"
      },
      {
        "id": "ffbc0488-c9ce-4359-b79b-486ced18a5c7",
        "name": "ns2.com-signin.site"
      },
      {
        "id": "8be5da21-8591-458d-a31d-de5b083a22e6",
        "name": "microsotf.comi-site.website"
      },
      {
        "id": "409635d8-328f-4cf4-92ec-a7016af64fcf",
        "name": "ns1.com-signin.site"
      },
      {
        "id": "2065e099-e2e7-4c17-9f09-85dac3cf862b",
        "name": "microsoft.comesite.website"
      },
      {
        "id": "27d64384-78a7-4a0e-a8e6-e13ac1291cfb",
        "name": "min.comview.website"
      },
      {
        "id": "a7997bae-1140-4dc8-be3c-2d060d22e82b",
        "name": "www.google.com-accounts.website"
      },
      {
        "id": "643847dc-510c-4ccd-a3e5-1b48f6f0deed",
        "name": "c.pis2ray.online"
      },
      {
        "id": "768952f5-1df1-4203-be47-d9921db310ed",
        "name": "google.com-accounts.website"
      },
      {
        "id": "2c9f9c48-161d-4262-a635-21a37617d55c",
        "name": "microsoft.pis2ray.online"
      },
      {
        "id": "39264020-f2ab-4774-8e3f-799b013d0b10",
        "name": "www.yeplayer.store"
      },
      {
        "id": "0655336e-1463-4a11-82ff-590aef8c42b4",
        "name": "microsoft.comview.website"
      },
      {
        "id": "d9ad671b-60ec-4110-8fc6-0dda2b5ff88e",
        "name": "min.comi-site.website"
      },
      {
        "id": "b27d5237-267c-4095-9ea5-6cb10d1d7c0d",
        "name": "microsoft.come-site.website"
      },
      {
        "id": "e43e02e0-15cb-4509-a9da-dce3558a7f8d",
        "name": "min.come-site.website"
      },
      {
        "id": "b3eb727e-2f98-439f-8c40-1dac9358fd22",
        "name": "www.instagram.com-accounts.website"
      },
      {
        "id": "df070199-8af6-4b6e-bdad-3b271488263a",
        "name": "www.pis2ray.online"
      },
      {
        "id": "5d0a0a7c-743b-4866-a599-27635bbf4bbf",
        "name": "vpn.pis2ray.online"
      },
      {
        "id": "eee72b41-4628-4958-af14-fe674514b2ee",
        "name": "webmail.com-accounts.website"
      },
      {
        "id": "3b77d622-8a5d-4ec1-9cf4-53cbaf701808",
        "name": "admin.google.com-accounts.website"
      },
      {
        "id": "3d451630-556f-447a-97e4-f306beab1585",
        "name": "microsotf.come-site.website"
      },
      {
        "id": "3e346267-f416-4eab-928e-dfd7d227adcd",
        "name": "webmail.facebook.com-accounts.website"
      },
      {
        "id": "f3708c0f-f3a7-45e0-b223-2b8e54a0c14f",
        "name": "www.yemplayer.site"
      },
      {
        "id": "ee2df1d8-413c-496b-abe2-c557969b2053",
        "name": "accounts.google.comisignin.online"
      },
      {
        "id": "7940d82d-8d58-4ed2-bc70-3757dafae0cc",
        "name": "google.com-signin.site"
      },
      {
        "id": "f7b0775b-eb27-4347-ac6c-2a9e5ae703e9",
        "name": "google.comisignin.online"
      },
      {
        "id": "a8769b16-5e67-4e2a-9368-ab07bc9fcafa",
        "name": "microsoft.comi-site.website"
      },
      {
        "id": "46d9021b-1fbd-4813-b290-ef917b620768",
        "name": "prx.pis2ray.online"
      },
      {
        "id": "35ebe097-fc06-49e4-9194-f4cd4242cc15",
        "name": "webmail.google.com-accounts.website"
      },
      {
        "id": "bc503ef3-f556-4b28-be4a-1251996dafaa",
        "name": "accountes.google.comesignt.website"
      },
      {
        "id": "fe25b782-f769-4f35-988f-7ab6f6b1d832",
        "name": "vip.yeplayer.store"
      },
      {
        "id": "ab86811d-2a5b-4d6a-ac68-b7cec6378a09",
        "name": "host.comview.website"
      },
      {
        "id": "f3bf9f7a-9fde-48ad-9bf7-3be21d3901c1",
        "name": "starvpn.pis2ray.online"
      },
      {
        "id": "0cd31ada-796d-43f1-9415-a7bce5210a33",
        "name": "45.86.162.197"
      },
      {
        "id": "ac000051-3512-42b9-bb7a-6ffae953e7a7",
        "name": "89.144.145.239"
      },
      {
        "id": "fb4a2e9c-0dbb-4479-99dc-6d9ccce10a22",
        "name": "46.30.191.105"
      },
      {
        "id": "a6e62e2e-8797-4a22-ba71-e538102e6e75",
        "name": "46.30.191.123"
      },
      {
        "id": "e21b5702-6315-4a06-898e-305839d93ee2",
        "name": "89.144.145.237"
      },
      {
        "id": "64b85514-c901-4120-8be3-39d837e0f197",
        "name": "https://vip.yeplayer.store/files/YEPlayer.rar"
      }
    ]
  },
  "external_refs": [
    {
      "id": "2f82137a-43ea-412a-bd0f-80a81a5dcd6d",
      "standard_id": "external-reference--2c1e70ac-ad00-52f1-b697-fec5798c6560",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.recordedfuture.com/research/media_11d60acbcd8901a8e5c5002f7f21ae6e799acee43.gif?width=1200&format=pjpg&optimize=medium",
      "hash": null,
      "external_id": null,
      "created": "2026-07-02T07:14:38.956Z",
      "modified": "2026-07-02T07:14:38.956Z",
      "createdById": null
    },
    {
      "id": "e54f2f5a-ca7f-4968-8a1a-cdb5fa16111a",
      "standard_id": "external-reference--3553b59c-ec5f-5e1c-8827-a2675838a5f1",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a45471afccee96152675f88",
      "hash": null,
      "external_id": "6a45471afccee96152675f88",
      "created": "2026-07-02T07:14:38.880Z",
      "modified": "2026-07-02T07:14:38.880Z",
      "createdById": null
    },
    {
      "id": "355d2fee-1572-4465-87a4-94a0f5edf3a5",
      "standard_id": "external-reference--c9076ebe-0d9c-51c6-a79e-246badfab295",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat",
      "hash": null,
      "external_id": null,
      "created": "2026-07-02T07:14:38.919Z",
      "modified": "2026-07-02T07:14:38.919Z",
      "createdById": null
    }
  ]
}