BREAKING: Two teenagers charged over 'Scattered Spider' Transport for London cyber attack. About to appear in court for first time. I'm here for BBC so follow the story for updates: www.bbc.co.uk/news/article...

It's truly enjoyable to see the efforts of the Islamic Republic's cyber forces as they try to use social engineering on me.

Your cyber threat intel is part of the North Korean strategy: DPRK operators are abusing CTI platforms to see if they’ve been seen—and moving faster because of it. 👀

Granular look here from @ajvicens.bsky.social and I on how job seekers in the crypto currency industry are being bombarded with fake job offers from North Korean hackers. Based on 19 interviews with targets and research from cyber firms @sentinelone.com and Validin www.reuters.com/world/asia-p...

🤣🤣🤣🤣🤣🤣

A recent security issue announced by Salesloft has impacted many companies, including Cloudflare. Read more https://blog.cloudflare.com/response-to-salesloft-drift-incident/?utm_campaign=cf_blog&utm_content=20250902&utm_medium=organic_social&utm_source=bluesky

A UK government study has found that, despite being aware that cyber insurance exists and is an option, most British companies struggle to understand insurance policy details, which is impeding a broader adoption www.gov.uk/government/p...

Screw it, unlocking the paywall on my Charming Kitten investigation. Everyone should know how they're impersonating former Pentagon officials to target activists. Full technical details, IoCs, everything that was VIP-only is free now vip.narimangharib.com/charming-kit... #APT35

The Islamic Republic is floating the idea of unblocking Telegram again blog.narimangharib.com/posts/2025%2...

LabDookhtegan paralyzed 64 Iranian ships at sea last night, again... blog.narimangharib.com/posts/2025%2... #Iran #CyberAttack

In May, we, alongside CBC's Visual Investigation Unit, @tjekdet.dk and @politiken.dk revealed the identity of the key administrator behind one of the largest AI porn sites. Dutch politicians across political parties are now calling for the Canadian to be extradited. www.cbc.ca/news/canada/...

Iran's defense sector offers $213,000 prize for counter-drone technology, seeking systems to detect and neutralize small UAVs through jamming, AI tracking, or physical interception. Competition highlights Tehran's push for indigenous anti-drone capabilities hxxps://archive[.]is/qCyIt

Tonight, Iran International TV exposed the identity of a Handala hacking group admin—part of the Banished Kitten cyber unit I've previously reported on—and unmasked his handler in Iran's Ministry of Intelligence. - Morteza Aftabi-Far - Ali Bermoudeh

Remember his name: Hesam Roshani. #APT39

Iranian 'security firm' #Amnban targeted 17+ global airlines in state-sponsored espionage. CEO hired US/FBI-sanctioned hacker, built shadow infrastructure with dozens of fake emails worldwide. Full story with leaked internal documents: blog.narimangharib.com/posts/2025%2... #APT39

Exclusive: 'They yanked their own plug': how Co-op averted an even worse cyber attack. Details sent to me by the angry Co-op hackers shows quick thinking from Co-op staff narrowly averted a full ransomware attack. www.bbc.co.uk/news/article...

New from 404 Media: the age of realtime deepfake fraud is here. Scammers in Nigeria are using realtime deepfakes to change their race, facial hair, gender, more to appear as someone else on video calls. Results very realistic now. Also tricking verification systems www.404media.co/the-age-of-r...

Major Data Breach at #Iran's Largest Mobile Operator (MCI) Exposes 30 Million Customers' Personal Information blog.narimangharib.com/posts/2025%2...

Exciting updates are on the way! I’ll soon be sharing exclusive, special content with you. Please note that some topics will no longer be shared publicly moving forward. Thank you for your continued support and understanding!

No caption needed.

New, by me: Someone hacked into the Everest ransomware gang's dark web leak site and defaced it. "Don't do crime CRIME IS BAD," Everest's site now reads.

NEW: Oracle is apparently dealing with two separate breaches — one affecting Oracle Cloud, and one Oracle Health — but the company refuses to say what's actually going on. Both public and employees are confused at this point, as there is little transparency. Here'sa recap of what's happening.

MuddyWater/UNC3313 still abuse OneHub and Atera agent: ws.onehub[.]com/files/hfluywkv התוכנית החדשה של המוסד לבטיחות ולגהות.zip b74514081fd6a4d4c2b86c06ec16d9c5 התוכנית החדשה של המוסד לבטיחות ולגהות.msi e3ed457861e8930d04016d6c2eaeb9b1

The Cyber Police of Iran, seeing an opportunity to push further, are now targeting activists' YouTube accounts by accessing their Gmail credentials, after Instagram and Meta did not take action to prevent their recent attempts to seize and delete Instagram accounts of singers and online activists.

IoCs: drives[.]googles[.]com-id-sddsdssd[.]fu58di30d8u8u2t976kg90i4fuj48duy7398wa73ahfd398a3suhyu456eh2q[.]site accent-going-session[.]bond cheking-panel[.]site cheking-panel-step[.]site human-queer-write[.]cyou forward-goal-inner[.]digital join-room-host[.]site join-room-check[.]site and more.

A new Telegram phishing website, launched by the IRGC, has begun targeting journalists in the U.K. today. Please block it on your network: hxxps://spam-telegram[.]org - I have already added this URL to: telegramaware.com

Imagine a platform built for connection becoming a tool for repression. Iran's cyber police are silencing voices by confiscating Instagram accounts. Will Meta take action to protect Iranian users against this digital seizure? blog.narimangharib.com/posts/2025%2...

A new botnet named Eleven11bot has infected over 30K devices and is being used to launch large-scale DDoS attacks against telecom providers and gaming platforms Most of the devices are NVRs and security cameras www.greynoise.io/blog/new-ddo...

A new and extensive surveillance network is covering Tehran's streets. According to information received from an informed source, the Islamic Republic is quietly installing advanced Chinese-made Hikvision cameras under pedestrian bridges.

#BanishedKitten www.timesofisrael.com/liveblog_ent...

Iran International TV revealed the identities of nine operatives from Parsian Rayan Borna (پارسیان افزار رایان برنا), a front company tied to the Ministry of Intelligence of the Islamic Republic. They conduct cyberattacks, like one on Albania, and manipulate public opinion via fake social accounts.

Apologies, everyone! I can’t upload videos longer than 1 minute here. However, you can check out the news about the BlackShadow group on your favorite social media platform, X. Unfortunately, that’s the best I can do— lol! x.com/NarimanGhari...

For years, only one or two images of his face were available on the internet. Yesterday, I came across a photo of him in military uniform during a meeting with Ali Khamenei, alongside other IRGC commanders, which I found quite interesting. iranianthreatactors.com/hamidreza-la...

Previously, information about Iran's cyber and cyber-electronics units was available only as images. To make it more accessible for security researchers and journalists, I've organized it into an easy-to-navigate chart on the website. cyberunits.iranianthreatactors.com

Iran International exposes Hossein Fard Siahpoush, aka Parsa Sarafian, for the first time. Key MOIS figure, board member of Avaye Hooshmand Ravin, and leader of #Darkbit hacking group. Linked to cyberattacks on Israeli targets, including Technion. iranianthreatactors.com/hossein-fard... 😜

Over the years, information about various cyber groups and individuals connected to the Islamic Republic has been leaked — or is currently being leaked — across numerous websites and TG channels. I created a website to compile and centralize all of this data in one location. iranianthreatactors.com

Message delivered.

The cyber group #Bakhtak,which previously hacked Astan Quds Razavi and the Martyrs Foundation, announced a few minutes ago that they have hacked the Foundation of the Oppressed of the Islamic Revolution and are currently uploading files from the foundation on their website and Telegram. #CyberAttack