Iran linked TAG-182 Uses Fake Apps to Spy on Dissidents

### Summary of TAG-182 Threat Cluster

• **Threat Actor:** TAG-182, suspected to be linked to Iran.
• **Activity Type:** Cyber surveillance and distribution of MarkiRAT malware.
• **Targets:** Iranian citizens and dissidents globally.
• **Methodology:** Utilizes fake VPN and media player applications to deploy malware.
• **Execution Process:** Downloads initiate a malware installation that connects to attacker-controlled servers.
• **Infrastructure:** Uses shared hosting services and focuses on persuasive advertising on social media, especially during internet outages.
• **Surveillance Tactics:** Malware maintains stealth via specific Windows services and processes, facilitating continuous data exfiltration.
• **Expected Trends:** Increased surveillance efforts as Iranian authorities aim to monitor citizens post-unrest. Users are warned to be cautious when downloading software.