Today I am presenting the call logs from #APT35's IRGC-IO official VoIP services. This exclusive information was previously detailed in episode 4 of the KittenBusters series. - files.narimangharib.com/other/FanapT... - files.narimangharib.com/other/Custom...

new blog post on #APT35 blog.narimangharib.com/posts/2025%2...

Exposing the identity of "Unit 40" managers of IRGC intelligence; Tehran's largest espionage intelligence database #APT35 #CharmingKitten content.iranintl.com/unit40/index...

Are you ready? Wait for new updates from the kittens. 😆

New Charming Kitten APT35 leak shows their entire budget. Bitcoin payments for domains and hosting, ProtonMail accounts (still active, I checked), Iranian shell companies, the whole operation running on maybe $10k.

Group-IB Threat Intelligence uncovered a sophisticated phishing campaign orchestrated by the Advanced Persistent Threat (APT) MuddyWater, targeting international organizations worldwide to gather foreign intelligence. www.group-ib.com/blog/muddywa... #RavinAcademy

A comprehensive database containing complete registration records of Ravin Academy students has been obtained by me, revealing detailed personal information of individuals enrolled in the organization's training programs. blog.narimangharib.com/posts/2025%2...

BellaCiao was developed at Tehran's Shuhada base. Moses Staff & Sahyoun24 weren't independent—all run by the same IRGC unit. MORE... blog.narimangharib.com/posts/2025%2... #APT35

Breaking News: Iranian Advanced Persistent Threat Group #APT35 Has Been Compromised, with Internal Documents Leaked Online blog.narimangharib.com/posts/2025%2...

BREAKING: Two teenagers charged over 'Scattered Spider' Transport for London cyber attack. About to appear in court for first time. I'm here for BBC so follow the story for updates: www.bbc.co.uk/news/article...

It's truly enjoyable to see the efforts of the Islamic Republic's cyber forces as they try to use social engineering on me.

Your cyber threat intel is part of the North Korean strategy: DPRK operators are abusing CTI platforms to see if they’ve been seen—and moving faster because of it. 👀

Granular look here from @ajvicens.bsky.social and I on how job seekers in the crypto currency industry are being bombarded with fake job offers from North Korean hackers. Based on 19 interviews with targets and research from cyber firms @sentinelone.com and Validin www.reuters.com/world/asia-p...

🤣🤣🤣🤣🤣🤣

A recent security issue announced by Salesloft has impacted many companies, including Cloudflare. Read more https://blog.cloudflare.com/response-to-salesloft-drift-incident/?utm_campaign=cf_blog&utm_content=20250902&utm_medium=organic_social&utm_source=bluesky

A UK government study has found that, despite being aware that cyber insurance exists and is an option, most British companies struggle to understand insurance policy details, which is impeding a broader adoption www.gov.uk/government/p...

Screw it, unlocking the paywall on my Charming Kitten investigation. Everyone should know how they're impersonating former Pentagon officials to target activists. Full technical details, IoCs, everything that was VIP-only is free now vip.narimangharib.com/charming-kit... #APT35

The Islamic Republic is floating the idea of unblocking Telegram again blog.narimangharib.com/posts/2025%2...

LabDookhtegan paralyzed 64 Iranian ships at sea last night, again... blog.narimangharib.com/posts/2025%2... #Iran #CyberAttack

In May, we, alongside CBC's Visual Investigation Unit, @tjekdet.dk and @politiken.dk revealed the identity of the key administrator behind one of the largest AI porn sites. Dutch politicians across political parties are now calling for the Canadian to be extradited. www.cbc.ca/news/canada/...

Iran's defense sector offers $213,000 prize for counter-drone technology, seeking systems to detect and neutralize small UAVs through jamming, AI tracking, or physical interception. Competition highlights Tehran's push for indigenous anti-drone capabilities hxxps://archive[.]is/qCyIt

Tonight, Iran International TV exposed the identity of a Handala hacking group admin—part of the Banished Kitten cyber unit I've previously reported on—and unmasked his handler in Iran's Ministry of Intelligence. - Morteza Aftabi-Far - Ali Bermoudeh

Remember his name: Hesam Roshani. #APT39

Iranian 'security firm' #Amnban targeted 17+ global airlines in state-sponsored espionage. CEO hired US/FBI-sanctioned hacker, built shadow infrastructure with dozens of fake emails worldwide. Full story with leaked internal documents: blog.narimangharib.com/posts/2025%2... #APT39

Exclusive: 'They yanked their own plug': how Co-op averted an even worse cyber attack. Details sent to me by the angry Co-op hackers shows quick thinking from Co-op staff narrowly averted a full ransomware attack. www.bbc.co.uk/news/article...

New from 404 Media: the age of realtime deepfake fraud is here. Scammers in Nigeria are using realtime deepfakes to change their race, facial hair, gender, more to appear as someone else on video calls. Results very realistic now. Also tricking verification systems www.404media.co/the-age-of-r...

Major Data Breach at #Iran's Largest Mobile Operator (MCI) Exposes 30 Million Customers' Personal Information blog.narimangharib.com/posts/2025%2...

Exciting updates are on the way! I’ll soon be sharing exclusive, special content with you. Please note that some topics will no longer be shared publicly moving forward. Thank you for your continued support and understanding!

No caption needed.

New, by me: Someone hacked into the Everest ransomware gang's dark web leak site and defaced it. "Don't do crime CRIME IS BAD," Everest's site now reads.

NEW: Oracle is apparently dealing with two separate breaches — one affecting Oracle Cloud, and one Oracle Health — but the company refuses to say what's actually going on. Both public and employees are confused at this point, as there is little transparency. Here'sa recap of what's happening.

MuddyWater/UNC3313 still abuse OneHub and Atera agent: ws.onehub[.]com/files/hfluywkv התוכנית החדשה של המוסד לבטיחות ולגהות.zip b74514081fd6a4d4c2b86c06ec16d9c5 התוכנית החדשה של המוסד לבטיחות ולגהות.msi e3ed457861e8930d04016d6c2eaeb9b1

The Cyber Police of Iran, seeing an opportunity to push further, are now targeting activists' YouTube accounts by accessing their Gmail credentials, after Instagram and Meta did not take action to prevent their recent attempts to seize and delete Instagram accounts of singers and online activists.

IoCs: drives[.]googles[.]com-id-sddsdssd[.]fu58di30d8u8u2t976kg90i4fuj48duy7398wa73ahfd398a3suhyu456eh2q[.]site accent-going-session[.]bond cheking-panel[.]site cheking-panel-step[.]site human-queer-write[.]cyou forward-goal-inner[.]digital join-room-host[.]site join-room-check[.]site and more.

A new Telegram phishing website, launched by the IRGC, has begun targeting journalists in the U.K. today. Please block it on your network: hxxps://spam-telegram[.]org - I have already added this URL to: telegramaware.com

Imagine a platform built for connection becoming a tool for repression. Iran's cyber police are silencing voices by confiscating Instagram accounts. Will Meta take action to protect Iranian users against this digital seizure? blog.narimangharib.com/posts/2025%2...

A new botnet named Eleven11bot has infected over 30K devices and is being used to launch large-scale DDoS attacks against telecom providers and gaming platforms Most of the devices are NVRs and security cameras www.greynoise.io/blog/new-ddo...