Nariman Gharib
@nariman.bsky.social
Britain-based Iranian Activist 🚦 Cyber Espionage Investigator 👁
www.iranintl.com/en/202606267... ..Amir Barati..
Iranian wanted in US over IRGC-linked hacking case arrested in Montenegro
Montenegrin police and the FBI have arrested an Iranian national wanted by the United States over a major hacking campaign that allegedly targeted US universities and benefited Iran’s Revolutionary Gu...
iranintl.com
Cheshm-e Oghab is a free app for Iranians: aggregates Persian and international news,auto-translates foreign coverage, and surfaces stories users submit through Telegram and (X) feeds. It runs on independent support. If you know someone who'd find it useful,please share cheshmehoghab.app/en/support/
Keep us on the air - Eagle Eye
Eagle Eye stays on the air thanks to people around the world. No company, no government, no ads. Only you.
cheshmehoghab.app
One of the safe houses of the IRGC Cyber Division HQ on Malekloo Street, Tehran, opposite Iran University of Science and Technology, was hit by a US and Israeli missile strike today This is the same facility from which Seyyed Ali Aghamiri, Yaser Balaghi, and Masoud Jalili launched phishing attacks.
Two years ago I had published this video. On March 4th, this target in Tehran was struck with a missile.
Sadly, I informed all authorities including DuckDNS in December, but they didn't take it seriously and still haven't shut down either the server or the DuckDNS infrastructure.
Runa Sandvik@runasand.bsky.social · 10mo agoSpoke to @zackwhittaker.com about a hacking campaign targeting high-profile Gmail and WhatsApp accounts across the Middle East, found by @nariman.bsky.social earlier this week. Gharib believes the campaign is linked to Iran, TechCrunch was unable to attribute it. techcrunch.com/2026/01/16/h...
New from the Charming Kitten #APT35 leak: Payroll records exposing 35 IRGC cyber operatives with names, bank accounts, and salaries. Additional footage of the Kashef surveillance platform tracking Iranian citizens. And a classified 2004 document... blog.narimangharib.com/posts/2025%2...
Charming Kitten Leak Continues: Payroll Data and a Stolen IAEA Document
In my previous analyses of the Charming Kitten leak, I examined the organizational structure, target lists, financial infrastructure, and operational capabiliti...
blog.narimangharib.com
The Ministry of Intelligence of the Islamic Republic's cyber group "Banished Kitten", which is operating under the name "Handala", has gained access to Suvarnabhumi Airport (BKK). blog.narimangharib.com/posts/2025%2...
Exclusive: Handala's Thailand Blunder - MOIS Accidentally Exposes Access to Bangkok Airport
The cyber group "Banished Kitten," operating under the alias "Handala" and affiliated with the Ministry of Intelligence and Security of Iran (MOIS), has once ag...
blog.narimangharib.com
NEW: Europol shut down Cryptomixer, a crypto service alleged to have facilitated the laundering of 1.3 billion euros since 2016. Service was allegedly used by cybercriminals, drug and weapons traffickers, and ransomware gangs. techcrunch.com/2025/12/01/e...
European cops shut down crypto mixing website that helped launder 1.3 billion euros | TechCrunch
Europol announced the seizure of Cryptomixer’s official website, as well as 25 million euros and 12 terabytes of data from the mixer's service.
techcrunch.com
Today I am presenting the call logs from #APT35's IRGC-IO official VoIP services. This exclusive information was previously detailed in episode 4 of the KittenBusters series. - files.narimangharib.com/other/FanapT... - files.narimangharib.com/other/Custom...
new blog post on #APT35 blog.narimangharib.com/posts/2025%2...
Department 40 Exposed: Inside the IRGC Unit Connecting Cyber Ops to Assassinations
A massive leak of internal documents has blown the cover off one of Iran's most active hacking groups. For years, the cybersecurity community tracked them as AP...
blog.narimangharib.com
Exposing the identity of "Unit 40" managers of IRGC intelligence; Tehran's largest espionage intelligence database #APT35 #CharmingKitten content.iranintl.com/unit40/index...
افشای هویت مدیران «اداره ۴۰» اطلاعات سپاه؛بزرگترین بانک اطلاعاتی جاسوسی تهران
content.iranintl.com
Are you ready? Wait for new updates from the kittens. 😆
New Charming Kitten APT35 leak shows their entire budget. Bitcoin payments for domains and hosting, ProtonMail accounts (still active, I checked), Iranian shell companies, the whole operation running on maybe $10k.
Episode 4: Inside Charming Kitten's Financial Operations and Infrastructure Network
The fourth release of leaked documents from Iran's APT35 (Charming Kitten) operation exposes something previous leaks haven't: the complete financial backbone a...
blog.narimangharib.com
Nariman Gharib@nariman.bsky.social · last yr.A comprehensive database containing complete registration records of Ravin Academy students has been obtained by me, revealing detailed personal information of individuals enrolled in the organization's training programs. blog.narimangharib.com/posts/2025%2...
Group-IB Threat Intelligence uncovered a sophisticated phishing campaign orchestrated by the Advanced Persistent Threat (APT) MuddyWater, targeting international organizations worldwide to gather foreign intelligence. www.group-ib.com/blog/muddywa... #RavinAcademy
group-ib.com
A comprehensive database containing complete registration records of Ravin Academy students has been obtained by me, revealing detailed personal information of individuals enrolled in the organization's training programs. blog.narimangharib.com/posts/2025%2...
Exclusive: Full Student Database of MOIS-Affiliated Ravin Academy Leaked
Based on the intelligence assessments from multiple government agencies, Ravin Academy functions as a MOIS-directed recruitment and training front operating und...
blog.narimangharib.com
BellaCiao was developed at Tehran's Shuhada base. Moses Staff & Sahyoun24 weren't independent—all run by the same IRGC unit. MORE... blog.narimangharib.com/posts/2025%2... #APT35
Part two and three of the leaked Charming Kitten files reveal operations across five continents
In my previous analysis of the Charming Kitten leak, I examined the unprecedented breach that exposed the inner workings of an Iranian state-sponsored hacking o...
blog.narimangharib.com
Breaking News: Iranian Advanced Persistent Threat Group #APT35 Has Been Compromised, with Internal Documents Leaked Online blog.narimangharib.com/posts/2025%2...
Massive Leak Exposes Inner Workings of Iranian Hacking Group Charming Kitten
In what appears to be one of the most significant breaches of an Iranian state-sponsored hacking operation to date, an anonymous source has published internal d...
blog.narimangharib.com
BREAKING: Two teenagers charged over 'Scattered Spider' Transport for London cyber attack. About to appear in court for first time. I'm here for BBC so follow the story for updates: www.bbc.co.uk/news/article...
Teenagers charged over Transport for London cyber attack
Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested
bbc.co.uk
www.international.gc.ca/transparency...
Iran-linked hacker group doxes journalists and amplifies leaked information through AI chatbots
Rapid Response Mechanism Canada (RRM Canada) has detected a “hack and leak” operation by Iran-linked hacker group, “Handala Hack Team” (Handala). The operation targeted five Iran International journal...
international.gc.ca
It's truly enjoyable to see the efforts of the Islamic Republic's cyber forces as they try to use social engineering on me.
Your cyber threat intel is part of the North Korean strategy: DPRK operators are abusing CTI platforms to see if they’ve been seen—and moving faster because of it. 👀
Granular look here from @ajvicens.bsky.social and I on how job seekers in the crypto currency industry are being bombarded with fake job offers from North Korean hackers. Based on 19 interviews with targets and research from cyber firms @sentinelone.com and Validin www.reuters.com/world/asia-p...
Exclusive: How North Korean hackers are using fake job offers to steal cryptocurrency
North Korean hackers are saturating the cryptocurrency industry with credible-sounding job offers as part of their campaign to steal digital cash, according to new research, raw data, and interviews.
reuters.com
