TAG-182 Deploys MarkiRAT in Escalating Iranian Surveillance Campaigns

Security researchers identified a new cyber surveillance campaign distributing a piece of malware known as MarkiRAT. The attackers used fake Android applications, specifically disguising them as VPNs and media players, to trick users into downloading the malicious software.

The campaign is attributed to a threat cluster tracked as TAG-182, which is highly likely part of the Iranian government's broader cyber-surveillance network. While their exact organizational affiliation is unconfirmed, their tactics closely mirror those of "Ferocious Kitten," a group notorious for targeting anti-government networks.

The primary goal of this campaign is intelligence collection and domestic surveillance. By infecting devices with the MarkiRAT software, the attackers aim to secretly monitor the digital activities and communications of their targets to support government security objectives.

The campaign is highly targeted rather than broad or indiscriminate. It focuses specifically on identifying and monitoring individuals perceived as dissidents or threats to the state, heavily utilizing social media platforms like Instagram to find targets.

The attackers specifically targeted Farsi-speaking users, including Iranian civilians, perceived dissidents, activists, and anti-government movements located both inside and outside of Iran. They aimed to compromise personal devices to monitor digital activities and collect sensitive intelligence.

Attackers promoted fake applications—like "Pis2ray VPN" or "YESHICA YEPlayer"—through social media posts, taking advantage of users looking for ways to bypass internet restrictions. When targets downloaded and installed these seemingly helpful tools, the hidden MarkiRAT malware was secretly installed on their devices, giving the attackers remote surveillance capabilities.

Following recent street protests and a massive 88-day internet shutdown in Iran, the government is intensifying its internal security measures. Dissidents and activists are highly attractive targets because monitoring them allows authorities to detect opposition, track anti-government sentiment, and enforce strict digital and physical control.

Individuals should strictly avoid downloading applications from unverified sources or links shared on social media, sticking only to official app stores like Google Play or the Apple App Store. Organizations should update their network defenses using the identified technical indicators and monitor for unauthorized background system activities.