Sadly, I informed all authorities including DuckDNS in December, but they didn't take it seriously and still haven't shut down either the server or the DuckDNS infrastructure.

New from the Charming Kitten #APT35 leak: Payroll records exposing 35 IRGC cyber operatives with names, bank accounts, and salaries. Additional footage of the Kashef surveillance platform tracking Iranian citizens. And a classified 2004 document... blog.narimangharib.com/posts/2025%2...

wait for it.

#CK 194[.]76[.]226[.]226

The Ministry of Intelligence of the Islamic Republic's cyber group "Banished Kitten", which is operating under the name "Handala", has gained access to Suvarnabhumi Airport (BKK). blog.narimangharib.com/posts/2025%2...

NEW: Europol shut down Cryptomixer, a crypto service alleged to have facilitated the laundering of 1.3 billion euros since 2016. Service was allegedly used by cybercriminals, drug and weapons traffickers, and ransomware gangs. techcrunch.com/2025/12/01/e...

Today I am presenting the call logs from #APT35's IRGC-IO official VoIP services. This exclusive information was previously detailed in episode 4 of the KittenBusters series. - files.narimangharib.com/other/FanapT... - files.narimangharib.com/other/Custom...

new blog post on #APT35 blog.narimangharib.com/posts/2025%2...

Exposing the identity of "Unit 40" managers of IRGC intelligence; Tehran's largest espionage intelligence database #APT35 #CharmingKitten content.iranintl.com/unit40/index...

Are you ready? Wait for new updates from the kittens. 😆

New Charming Kitten APT35 leak shows their entire budget. Bitcoin payments for domains and hosting, ProtonMail accounts (still active, I checked), Iranian shell companies, the whole operation running on maybe $10k.

Group-IB Threat Intelligence uncovered a sophisticated phishing campaign orchestrated by the Advanced Persistent Threat (APT) MuddyWater, targeting international organizations worldwide to gather foreign intelligence. www.group-ib.com/blog/muddywa... #RavinAcademy

A comprehensive database containing complete registration records of Ravin Academy students has been obtained by me, revealing detailed personal information of individuals enrolled in the organization's training programs. blog.narimangharib.com/posts/2025%2...

BellaCiao was developed at Tehran's Shuhada base. Moses Staff & Sahyoun24 weren't independent—all run by the same IRGC unit. MORE... blog.narimangharib.com/posts/2025%2... #APT35

Breaking News: Iranian Advanced Persistent Threat Group #APT35 Has Been Compromised, with Internal Documents Leaked Online blog.narimangharib.com/posts/2025%2...

BREAKING: Two teenagers charged over 'Scattered Spider' Transport for London cyber attack. About to appear in court for first time. I'm here for BBC so follow the story for updates: www.bbc.co.uk/news/article...

It's truly enjoyable to see the efforts of the Islamic Republic's cyber forces as they try to use social engineering on me.

Your cyber threat intel is part of the North Korean strategy: DPRK operators are abusing CTI platforms to see if they’ve been seen—and moving faster because of it. 👀

Granular look here from @ajvicens.bsky.social and I on how job seekers in the crypto currency industry are being bombarded with fake job offers from North Korean hackers. Based on 19 interviews with targets and research from cyber firms @sentinelone.com and Validin www.reuters.com/world/asia-p...

🤣🤣🤣🤣🤣🤣

A recent security issue announced by Salesloft has impacted many companies, including Cloudflare. Read more https://blog.cloudflare.com/response-to-salesloft-drift-incident/?utm_campaign=cf_blog&utm_content=20250902&utm_medium=organic_social&utm_source=bluesky

A UK government study has found that, despite being aware that cyber insurance exists and is an option, most British companies struggle to understand insurance policy details, which is impeding a broader adoption www.gov.uk/government/p...

Screw it, unlocking the paywall on my Charming Kitten investigation. Everyone should know how they're impersonating former Pentagon officials to target activists. Full technical details, IoCs, everything that was VIP-only is free now vip.narimangharib.com/charming-kit... #APT35

The Islamic Republic is floating the idea of unblocking Telegram again blog.narimangharib.com/posts/2025%2...

LabDookhtegan paralyzed 64 Iranian ships at sea last night, again... blog.narimangharib.com/posts/2025%2... #Iran #CyberAttack

In May, we, alongside CBC's Visual Investigation Unit, @tjekdet.dk and @politiken.dk revealed the identity of the key administrator behind one of the largest AI porn sites. Dutch politicians across political parties are now calling for the Canadian to be extradited. www.cbc.ca/news/canada/...

Iran's defense sector offers $213,000 prize for counter-drone technology, seeking systems to detect and neutralize small UAVs through jamming, AI tracking, or physical interception. Competition highlights Tehran's push for indigenous anti-drone capabilities hxxps://archive[.]is/qCyIt

Tonight, Iran International TV exposed the identity of a Handala hacking group admin—part of the Banished Kitten cyber unit I've previously reported on—and unmasked his handler in Iran's Ministry of Intelligence. - Morteza Aftabi-Far - Ali Bermoudeh

Remember his name: Hesam Roshani. #APT39

Iranian 'security firm' #Amnban targeted 17+ global airlines in state-sponsored espionage. CEO hired US/FBI-sanctioned hacker, built shadow infrastructure with dozens of fake emails worldwide. Full story with leaked internal documents: blog.narimangharib.com/posts/2025%2... #APT39

Exclusive: 'They yanked their own plug': how Co-op averted an even worse cyber attack. Details sent to me by the angry Co-op hackers shows quick thinking from Co-op staff narrowly averted a full ransomware attack. www.bbc.co.uk/news/article...

New from 404 Media: the age of realtime deepfake fraud is here. Scammers in Nigeria are using realtime deepfakes to change their race, facial hair, gender, more to appear as someone else on video calls. Results very realistic now. Also tricking verification systems www.404media.co/the-age-of-r...

Major Data Breach at #Iran's Largest Mobile Operator (MCI) Exposes 30 Million Customers' Personal Information blog.narimangharib.com/posts/2025%2...

Exciting updates are on the way! I’ll soon be sharing exclusive, special content with you. Please note that some topics will no longer be shared publicly moving forward. Thank you for your continued support and understanding!

No caption needed.

New, by me: Someone hacked into the Everest ransomware gang's dark web leak site and defaced it. "Don't do crime CRIME IS BAD," Everest's site now reads.

NEW: Oracle is apparently dealing with two separate breaches — one affecting Oracle Cloud, and one Oracle Health — but the company refuses to say what's actually going on. Both public and employees are confused at this point, as there is little transparency. Here'sa recap of what's happening.

MuddyWater/UNC3313 still abuse OneHub and Atera agent: ws.onehub[.]com/files/hfluywkv התוכנית החדשה של המוסד לבטיחות ולגהות.zip b74514081fd6a4d4c2b86c06ec16d9c5 התוכנית החדשה של המוסד לבטיחות ולגהות.msi e3ed457861e8930d04016d6c2eaeb9b1