CuraSec

tag: Iran-Apt · 2 items

Act archived Iranian Intel Service Uses Telegram C2 Malware to Spy on Dissidents
2026-09-16 · The Hacker News · source ↗ #iran-apt#telegram-c2#windows-malware
  • Engineer — Skip
  • SOC/IR — Act: Joint US/UK/NL advisory details active Windows malware using Telegram as C2 with email exfil, screenshot, and audio capture capabilities; pull the full advisory for IOCs and hunt for anomalous Telegram API calls or beacon traffic patterns in your estate since the advisory’s disclosure date.
  • Leader — Learn: Multi-government attribution of Iranian intelligence espionage tooling targeting journalists and dissidents; relevant background for risk context in media, NGO, or government-adjacent sectors, and useful framing for board discussions on geopolitical threat actors.
Learn archived U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches
2026-08-26 · The Hacker News · source ↗ #iran-apt#sanctions#critical-infrastructure
  • Engineer — Skip
  • SOC/IR — Learn: Attribution of Iranian cyber actors to critical infrastructure breaches is useful for sector threat modeling, but the summary contains no IOCs, TTPs, or detection-ready material to act on.
  • Leader — Learn: Relevant geopolitical context for board-level risk briefings on nation-state threats to critical infrastructure, but no specific sectors or victims are named here, so no immediate exposure assessment is warranted.