This week we’ll dive into the election interference documents declassified by Trump not long ago. There are a few dozen documents in total, some of which are more interesting than others. Regardless, they’re a great look at finished analytical products from the US intelligence community and include a few interesting datapoints.

The documents go back to the 2020 elections.

One analytical document covers how China runs cyber operations for espionage targeting senior US leadership and other bodies - nothing super interesting or groundbreaking here, but still interesting to see how that’s covered, including the use of APT taxonomy.

The more interesting component, to me at least, was China’s use of public data, namely US voter registration data, for targeting and presumably to run influence operations. We don’t see much on where they get it in some of the earlier documents,

This is a recurring trend, with other documents referring to Chinese use of other databases, including consumer, military and other databases.

While for some reason some of this is redacted below, it’s possible to reasonably infer that the second half’s reference to to “conduct REDACTED opinion… analysis” on the US elections, is in fact referring to public opinion or voter opinion analysis.

We get some other interesting documents later on, in which we see that China has a “document” that contained a list of entities and relevant data. This includes datasets of PII, such that “bulk collection of such PII had been their goal”, with some focusing on voter registration.

Below we even see that 97 entries in the list are US-origin.

It’s obvious that the document is referring to hacked or purchased databases, with China creating their own fused databases of global data based on the targets they hit.

This becomes clearer below, in which we see actual lists of databases acquired by China.

We see a wealth of voter databases:

Medical and private-sector DBs are here as well:

Same goes for other companies:

Below we even see that they’re definitely buying data, with one set called “America“ taken from the hacking forum Exploit:

They of course fuse social media databases as well:

We see some other specific orgs targeted, with another one also being taken from a hacking forum I presume - the “2014 business cards” one:

So, China is making their own databases of global breached data. It’s what I’d be doing if I were them for sure, giving them broad information on US citizens as well as useful selectors for targeting, cyber and influence operations.

It’s fascinating to see just how available voter registration data is as well, with one Chinese APT simply downloading it from a website:

We also get some references to China running online IO, but what I can’t understand - why redact what is probably Spamouflage?

We also get some other fun graphics from internal reporting, which I’m including mainly for fun:

On that note, we’ll wrap things up.

Imagine being able to pull up a normalized database of hundreds of millions of Americans with their name, address, age, email address and phone number, social media accounts and more - the potential for targeting is endless. That’s what China is doing, and don’t be surprised - I’m sure that the US and other countries are doing this as well. If there are commercial companies out there doing it well, there’s no reason that governments aren’t.

So we get the potential for fusing databses, but the next step, which is scarier if more targeted, would be aggregating infostealer logs. And on that positive note, we’ll end this week’s post. Thanks for reading.

Moving on, I came across an interesting post from Ahmad Batebi, an Iranian dissident.

Batebi was targeted by a phishing operation meant to take over his Telegram account, presumably because he’s involved in running a prominent channel:

Batebi added that he was sent AI-generated audio files to mimic the voice of someon else, and then he was sent a link to a “private Telegram group”. He noticed that the domain used “teiegram” instead of “telegram”, which looks similar in lower case as sent.

This is visible in the video he uploaded, as he recorded the entire interaction:

Checking out that domain finds some relevant subdomains - including other methods used, such as Microsoft Teams:

I’ll save everyone the trouble, but avoiding the Cloudflare IPs (104 and 172, and Google on 108), we can find some VPSes used by the operation, including from UltaHost and OVH.

OVH is less commonly used by Iranian actors, but UltaHost is frequently used by Iranians. Both used Russian domain name registration services also, which is quite common.

Moving on to other things Iranian, an Iranian hacker was arrested recently in Montenegro at the request of the FBI.

Kim Zetter has the best coverage of this IMO, tying it to a 2018 indictment of IRGC-linked cyber operators.

This will be an interesting one to keep an eye on for when any indictments or other documents come out.

I’ll conclude with a recommendation - check out Cognitive Warfare from Japan below. Kazuki is putting out great stuff already and worth of your follow.

Cognitive Warfare from Japan

Tracking the Second Wave of Green Cicada: An Independent Investigation of a Chinese AI-Driven Persona Network on X

July 12, 2026…

Read more

17 days ago · Kazuki Ichida

That’s it for this week, thanks for reading.

Check out Max’s work below, and as always - guest posts are the sole opinion of the guest author.

All statements made here are made with the public interest and are the result of good-faith investigation. This post draws on publicly accessible technical data, domain records, platform metadata, and other open-source data. While the analysis identifies correlations and patterns, certain claims remain unverified and have not been formally established in legal proceedings. The findings should be understood as an evidence-based assessment of observable data, not a determination of wrongdoing.

Suspicious Consulting Firms Targeting Foreign Policy and Defense Professionals

My name is Max Lesser and I work with Ari at Foundation for Defense of Democracies. I collaborated with my intern Thomas Crehan on this analysis.

On June 30, 2026, Bill Hayton, a China specialist, posted on X, asking “Has anyone else heard of the ‘Institute of East Asia Strategic Studies’ apparently based in Singapore since 2019? They seem to be approaching Western security analysts. Is it just another front organization for China’s Ministry of State Security?” Hayton also shared a related domain: ieass[.]com.

Figure: X post from Bill Hayton on June 30, 2026, mentioning the “Institute of East Asia Strategic Studies, which claims to be based in Singapore, reaching out to Western security analysts

Ieass[.]com presents itself as a website for a Singaporean geopolitical advisory firm. Domain infrastructure analysis of ieass[.]com reveals that it is very likely connected to two other similar websites presenting themselves as geopolitical advisory firms: easi-policy[.]com and sgas-strategy[.]com. As of July 9, 2026, none of these websites disclose connections to each other, such as mentioning a relationship on their respective webpages. A fourth domain also shares several – but not all – common technical features with these three domains, and it also presents itself as a geopolitical advisory firm: northriver-asia[.]org.

Figure: IEASS Home Page, including a “hiring” banner

The network spanning ieass[.]com, easi-policy[.]com, sgas-strategy[.]com and the likely related domain – northriver-asia[.]org – exhibit qualities consistent with previous Chinese virtual espionage operations. Though more work can be done to strengthen attribution, this analysis aims to proactively flag these websites as suspicious so that current and former government officials and foreign policy professionals can be alert if approached by individuals or personas associated with these firms.

Technical Indicators Tie Together ieass[.]com, easi-policy[.]com, and sgas-strategy[.]com

As mentioned above, China policy expert Bill Hayton first flagged the domain ieass[.]com on X. Ieass[.]com served as the initial lead for this investigation.

DNS records, accessed via the DomainTools Iris platform, show that ieass[.]com has nearly-identical registration and infrastructure profiles to two other domains, easi-policy[.]com and sgas-strategy[.]com. Specific technical indicators are withheld here to avoid providing threat actors a roadmap for future evasion; vetted researchers may request additional detail.

Additionally, multiple technical features show that all three sites appear to use Lovable, an AI-enabled site builder platform. For example, as per URLScan[.]io, scripts across all three websites are served by an origin whose reverse DNS resolves to an endpoint associated with Lovable, lovable-app-cd-1-4[.]p[.]l5e[.]io.

All three websites also were registered within a two-month period, and easi-policy[.]com and sgas-strategy[.]com were registered within three days of each other: ieass.com was registered on 2026‑03‑21, easi-policy.com was registered on 2026‑05‑09, and sgas-strategy[.]com was registered on 2026‑05‑12.

Figure: EASI Home Page

Based on the nearly-identical registration and infrastructure profiles, ieass[.]com, easi-policy[.]com, and sgas-strategy[.]com very likely share common ownership and control. All three sites were also built using Lovable, an AI-enabled site-builder platform, consistent with rapid, low-cost deployment of the cluster. Despite this, we did not identify any overt cross-references between the sites (e.g., mutual citations, shared bylines, or partner listings) as of July 9, 2026. Combined with each site’s distinct, unrelated branding, this absence of visible linkage suggests the owner or operator of the websites intends to conceal the connection between the domains.

Shared qualities across ieass[.]com, easi-policy[.]com, sgas-strategy[.]com

In addition to infrastructure overlap, ieass[.]com, easi-policy[.]com, sgas-strategy[.]com share similar qualities. All three present themselves as websites for geopolitical advisory firms, respectively named Institute of East Asia Strategic Studies (IEASS), East Asia Strategic Insights (EASI), and Sentinel Global Affairs & Strategy (SGAS). IEASS and EASI claim to be based in Singapore, and SGAS claims to be based in Paris.

All three websites have similar target profiles on their “Career” or “Partnerships” pages. SGAS’s explicitly says it seeks professionals with “experience in government, armed forces, international organizations or consulting.” EASI seeks partnerships with those who “hold deep experience across politics, military, diplomacy, industry or markets.” IEASS does not explicitly call for people with experience in politics, government, or the military, but it advertises job listings for a “Remote Geopolitical Consultant” and a “LinkedIn Remote Recruitment Specialist.” Additionally, IEASS and SGAS appear to have LinkedIn pages.

As of July 7, 2026, no entities with matching profiles appear in corporate records databases such as OpenCorporates or Sayari. On top of this, several websites display inconsistencies or strange content casting doubt on whether they represent authentic consulting firms.

For example, the homepage of sgas-strategy[.]com lists the coordinates 52.5200°N, 13.4050°E as its “Paris Operations,” but these coordinates correspond to Berlin, Germany, not Paris. The team page for SGAS anonymizes the names of its staff members by only showing initials. EASI highlights “Media Mentions” for Tier-1 media outlets such as Reuters on its homepage, but web searches did not corroborate that these quotes are authentic. Its research page also provides arrows linking to “public commentary” that cannot actually be clicked.

Northriver-asia[.]org’s plausible connection to the network

A fourth domain, northriver-asia[.]org, also has infrastructure overlap with the network and exhibits similar behaviors, presenting itself as a geopolitical advisory firm based in London. The associated website also uses Lovable.

On top of these shared technical indicators, northriver-asia[.]org also presents itself as a geopolitical advisory firm. The website, however, has indicators of inauthenticity that are even more glaring than the other sites. For example, while the website almost exclusively uses English, the site’s “People” page appears to mistakenly include simplified Chinese-language text reiterating the title of ones of its claimed employee.

Northriver-asia[.]org lists +1 202 555 0174 for its Washington D.C contact. This number falls within the 555-0100 through 555-0199 range, which is reserved for fictitious and non-functional numbers used for entertainment and advertising uses. Similarly, Northriver-asia[.]org lists a London number, +44 (0)20 7946 0188, and an out-of-hours number, +44 (0)20 7946 0199, on their contact page; both fall within Ofcom’s 020 7946 0000 to 020 7946 0999 drama-number range. Moreover, northriver-asia[.]org claims to be a registered UK charity with registered Charity “No. 1149732,” but the UK Charity Commission lists that number as belonging to the Kurdish Council of Imams & Preachers in Britain. Finally, the website claims a London address at 32 Old Queen Street, London SW1H, which appears to be a historic rowhome in London.

Because northriver-asia[.]org does not share the most distinctive infrastructure tie that is shared among ieass[.]com, easi-policy[.]com, sgas-strategy[.]com, it is less clear whether it shares ownership and control with these domains. At the same time, the website has a similar profile to the other websites, suggesting that it represents similar activity and may share operational ties. Unlike the other three domains, northriver-asia[.]org does not appear to have a career or partnership page seeking resumes or applications from professionals with political, government, or military experience. However, the website’s profile suggests that it may be used for this purpose in the future.

Conclusion

Hayton’s X post provided an investigative lead that revealed a broader network of at least three websites, and one likely related website, all representing suspicious geopolitical advisory firms. The network of three domains explicitly targets professionals with former government or military experience. While concrete attribution requires further research, the above analysis is sufficient to establish that these websites are suspicious. Moreover, they fit the profile of historical Chinese virtual espionage campaigns, which often use inauthentic geopolitical advisory firms that target former government and military personnel, and which historically operate networks of websites that share infrastructure but conceal their true connection to each other.

This research was published with the intention of building situational awareness of suspicious activity and enabling proactive takedown of the domains and associated profiles or job listings on professional networking and freelancing websites.

This week we’ll check out some interesting activity and commentary from China.

The first is Tsinghua’s Center for International Security and Strategy and their 2026 “External Security Risks for China” report, available here.

Tsinghua’s CISS is headed by one Da Wei.

Da Wei was previously employed in the MSS’s 11th Bureau, meant to “engage with foreign scholars… to influence foreign policy debates”. Da Wei’s program also hosts exchange programs for US students coming to China:

That makes this document more interesting than just a straightlaced threat analysis document or national intelligence assessment. The document is meant to share China’s perspectives and narratives globally.

Don’t just take it from me. This is apparent in the two objectives of the CISS as per its website:

• One: “follow the changes in global dynamics, offering policy suggestions… through researches on topics of international order, international relations and security and strategic studies…”

• Two: elucidate and disseminate China’s perspectives nad policy propositions… to enhance the international community’s understanding of China…”

We can see this expressed in the topics covered in the fairly short report, as well as the narratives present. I do sense some AI editing, with titles like “When the bubble meets the surplus”.

The document doesn’t read as the type of sober analysis one would expect from a prestigious think tank. Looking at the section focusing on China-Japan relations, we see that the report accuses Japan of stoking the “China Threat” narrative for domestic political purposes - a claim we’ve seen leveraged against the US and others - and of taking “provocative” action in other realms.

Having said that, the document is far more professional than other Chinese reporting.

We won’t dive in-depth to the other topics, instead focusing on the cyber component.

The cyber component focuses on “AI-driven cyberattacks”, claiming that China could face “large-scale, coordinated, state-level cyberattacks”. Not an entirely implausible phenomena, but there’s a lot of fearmongering.

The section also covers the “weaponization” of AI. On the whole, the section is comparatively tame, though it does dip its toes into fantastatical directions, such as “telecom fraud syndicators” carrying out “highly sophisticated cyber operations”.

Overall, comparatively tame. The same goes for their perception of quantum:

This dovetails nicely with a recent statement from Qihoo 360, China’s leading cybersecurity company and one that we’ve discussed many times before.

Qihoo announced that it has developed a model comparable to Anthropic’s Mythos. Reuters covered their statement, as 360 plays a leading role in promoting China’s influence efforts surrounding cyber in past years.

360’s founder, Zhou Hongyi, announced the two tools, which are named as a reference to a Chinese wuxia named “Yitian Tulong”, meaning “Heavenly Sword and Dragon Saber”. While I’m all for pop culture references, as the title of this post shows yet again, I’d love to see some classical Chinese references here. Maybe next time.

The tools focus on automatic discovery of vulnerabilities, while the other seemingly is the much-vaunted agentic SOC we’ve all waited for, with an IR team on the side.

Zhou also gave us some exposition on his perspective on AI, stating that China faces significant risk from Mythos and it not being available to the Chinese market.

Zhou said that 360 wouldn’t go down the “strongest model” route, instead going for “agents”.

This approach is a bit clearer one sentence down, but even then - the limitations of this approach are obvious. Why couldn’t Anthropic have both a “genius hacker” and a professional team?

I, personally, can’t wait for the upcoming 360 and CVERC joint reports on how Heavenly Sword and Dragon Saber fought off Mythos.

This element of competition between the US and China a,t the product and planning level, is interesting to see. There’s been a lot of discussion of US-China AI competition at the hardware level, model level and recently with distilling:

In this case done with tens of thousands of fake accounts:

Consider the scale of residential proxies and infra required to do this! Wonder if it would detract from other IO or cyber efforts, or if they’re using mainly black hat services.

That aside, 360 is doubling down and leading not only China’s fight on the product side, but the PR and StratComs as well. It’s only a matter of time before they set up some AI front group to publish reports like the CVERC.

That’s it for this week, thanks for reading.

The first that I want to share is from the Gnida project, which consistently puts out some of the best research on Russia. Some recent research of theirs showed how Israel’s back on their targeting list:

Staying on Israel for a minute, HaShomrim, an Israeli investigative news outlet, published in conjunction with the OCCRP a look at a number of Russian physical influence operations against Israeli and Jewish targets in Europe, check it out here.

The OCCRP has their original look at it, based on leaked documents, available here.

The article is fascinating and worth reading, giving rare insight into the operational planning of these types of operations. See an example which involved placing pig heads in front of mosques:

We get a look at the SDA (the company that runs Doppelganger) and their new venture targeting central Asia and the Caucasus:

We’ll conclude with two more recommendations for reading:

• A look at a Russian network on Bluesky

• An academic look at Russian sabotage and espionage operations

That’s it for this week, thanks for reading.

After the past few posts covered China, we’ll be going back to other topics this week.

The first is Iran. I published an investigation last week at the FDD - alongside Joe Truzman - looking at a persistent Iranian espionage operation, available here. Recorded Future (we’ll discuss below) first published on it.

Like other Iranian espionage operations covered here, this operation overtly identifies itself as Iranian:

This operation has some unique components. As per its name, it’s tied to the MOIS and not the IRGC. It also has three additional channels: the “HR” channel of VIPEmployment02bot, and “social media” channels in English/Hebrew and Arabic.

Readers of the blog may remember the VIPEmploymentBot operation from past posts - see here:

So, it’s back it seems, and is doubling down on the influence element.

The affiliate channel shares AI-generated propaganda content seeking to recruit Israelis in the “Mossad, Shabak the police forces and people with access to any national databases” alongside “regular people from all walks of life”:

The channel shares content from those actually recruited, at least allegedly:

The channel also shares content from Handala channels, mainly Handala Partisans, their latest recruitment effort:

The Iranian Intelligence Voice channel also shared general news-style propaganda in English, Hebrew and Arabic, while promoting the recruitment bot:

The channels have since been taken down, but share the same recent trends we’ve seen from Iran:

• Fusing recruitment for espionage and sabotage with influence operations

• Overt affiliation with Iran, presumably to sharpen the psychological impact while also filtering out recruits to those who don’t mind working for Iran

• Targeting Israeli defense and security personnel.

It’s interesting to see Iran-branded operations, let alone specific organizational affiliation. I wonder to what degree this is the MOIS learning from the IRGC or competition perhaps for clicks.

This operation mimics a fair amount from the previous IRGC operation targeting Israeli defense personnel, but it also shares the laissez-faire approach to operational security that the MOIS has. Whereas the IRGC operation targeted specific Israelis with SMSes and tried to avoid detection to some degree, the MOIS revels in its exposure.

Let’s move on. I want to shout out Recorded Future for putting out some great research as of late.

The first report I want to shout out is his look at Handala, available here. I know we’re all sick of Handala, at least I am, but it’s worth looking at and is quite comprehensive.

As stated at the beginning of this post, the report first exposed round 2 of the VIPEmploymentBot, pointing out its crossposting with Handala:

The report also covered the amplification of the VIPEmploymentBot and 02 historically:

He also points out that Iranian actors pushed the channel globally - from unrelated groups in Latin America to others - mainly to promote the IO side of the operation.

Some of the posts in Arabic called for “cooperation” from Muslims worldwide, calling on them to kill Americans and Israelis as well as their infrastructure, and of course upload propaganda content.

The report also looks at the historical side of things, with the BraveIL operation active in mid 2024 serving as as as an early stab at virtual espionage, a few months prior to the first VIPEmploymentBot operation:

Great stuff and I’d recommend reading it.

Another interesting report from Recorded Future was their exposure of a network of domains and services that enable the busting of sanctions for sanctioned vessels and companies. Really interesting stuff, including fake certificate generation and other services - check it out here.

That’s it for this week, thanks for reading.

This week we’ll check out Open AI’s latest report. This one is a bit shorter than usual and evokes a bit of self-interest, covering China-linked influence operations targeting “AI debates in the US”:

The summary is pretty concise:

The first operation they named “data center bandwagon”, when the very obvious RAM Bandwagon was right there. I personally would have gone with “make data center haters your waiters” had I not already used that reference in a previous blogpost. Happy to consult on future operation names guys! If you’re not going to do a relevant pop culture reference, at least make it a chengyu or something.

The operation is somewhat straightforward: China-origin accounts used ChatGPT to create content to denigrate data centers. These operators also made the unusual choice to upload their strategic planning documents to ChatGPT, presumably for better prompt results?

They used ChatGPT to create obviously AI-generated content describing how electricity bills are higher now, apparently due to data centers. They sought to make this content popular amongst Americans by using the almost household name hashtag of #capacityauction. They also used real coverage from local newspapers for authenticity.

Some other posts were even less inspired:

Other hashtags they tried to launch include #datacentersuccess and #datacenters, the last of which probably at least has some discourse on it.

Another cluster tried to target Chinese dissidents, something that many Chinese operations and Spamouflage in particular do:

Some accounts portrayed themselves as Chinese Americans or Chinese citizens living in America:

It’s interesting to see how the same network used ChatGPT for for their operational security and platform detection bypass methods.

Because these operators just don’t care, we gain insight into how they view bypassing Facebook’s safeguards:

Open AI named the next operation “Tech and Tariffs”, and I can already think of some better names.

This time, it’s personal:

This operation got up to a few different types of activity, including criticizing US tech and tariff policy, trying to design social listening systems and - gasp - editing work reports.

Open AI says that they used terminology similar to how China’s public security apparatus works - thus insinuating ties to the MPS or perhaps SHanghai police, which has also dabbled in similar stuff.

The most interesting part is the targeting of Open AI itself. The operation accused ChatGPT of suffering a data breach, exposing personal information of ChatGPT users:

They criticize Trump and praise China’s activity:

They’re not above dipping their toes into antisemitic content:

Funnily enough, they do the same thing that Spamouflage has done before: make the president look cool.

They also tried to get ChatGPT to propose a plan for an “AI system” for social listening. This is like the fourth time this has happened so far.

Other audiences were targeted as well:

One of the accounts also got into the cyber attribution space:

That user posted a timeline of alleged Western operations and tooling:

While it’s low-res, it seems to be translated from Chinese and presumably is an AI-generated timeline from past CVERC or other reporting. My initial thought of the most similar content was the China Cybersecurity Industry Alliance’s “report” on “mobile cyberattacks”. The timeline there is similar in content but presented visually:

Open AI assessed the operation as having no impact or breakout, but rightfully says that it is concerning due to its targeting of a private company.

So, some points here.

• Spamouflage is alive and well, and the MPS is presumably hiring local firms to help their efforts.

• China is fusing cyber attribution and influence operations in new ways, and they won’t stop targeting US companies, not just “legitimate” IO targets.

• They still can’t get their act together regarding mass scale operations, and also still are weirdly focusing on basic development for social listening. I imagine they have issues with data and access to platforms.

• AI is a scary industry for China, and they know that they can’t gain supremacy against frontier labs, and it’s best for them to thus limit America’s AI development as much as possible. Surprised we didn’t get amplification of AOC or Bernie Sanders’ insane moratorium bill.

• Open AI has an interest in promoting this type of stuff to protect their own interests, but they are also right to expose this and lobby for protection or action.

That’s it for now, thanks for reading.

When it rains, it pours. This emergency post is going to review, in-depth, the latest FBI affidavit exposing 13 Chinese virtual espionage domains.

Open AI also released a report on Chinese IO targeting data centers, which we will review in a later post.

Let’s dive right in. The FBI and DOJ announced a takedown of 13 Chinese virtual espionage domains, with the announcement and affidavit available here.

The affidavit is lengthy so we’ll focus on the key points.

The summary is straightforward:

By virtue of this being an FBI indictment, we get some information we don’t usually get just from open sources, such as their use of identity theft and information on correspondence between the handlers and those targeted:

LinkedIn, as well as multiple freelancing platforms, are mentioned as key hubs of activity:

Paypal and crypto are the main methods of payment:

The domains seized are listed:

The domains are interesting in that they’re more dispersed geographically than we usually see, with companies based in Europe and the Middle East - not just Taiwan, Hong Kong and Singapore:

Some of these are a bit older and frankly unimpressive:

We’ll skip ahead to their analysis of the domains. While there’s still much to be desired, the affidavit actually provides indicators and basic analysis of the domains. I’d call this a big step forward for FBI affidavits.

We see that the FBI relies on a few overly basic indicators, such as sharing a host server (and its affiliated IP address), without including more advanced domain analysis techniques. Hopefully we’ll see more of that soon. That aside, the FBI relies heavily on other heuristics, such as job text similarity, vagueness, stock photos and so on which we’re used to relying on here. In only a few cases are other indicators, such as impersonation, use of stolen identities or so on are brought up, and only three were the result of reports to the FBI.

We’re also lucky enough to get analysis of each domain. We won’t cover every single one, but there are some points to review. Firstly, the reliance on stolen credentials for individuals is interesting, with the operators relying on exposed credentials and information on US citizens to set up the infrastructure:

They use stock images - of course:

The operators have a sense of humor, which I appreciate greatly. Make espionage funny again.

Many of the domains go back at least 2 and sometimes 3 years. As we’ve shown on Memetic Warfare, Chinese espionage has also expanded to covering the Middle East and other “international hotspot” issues:

Many such cases of this:

Unique text is always a good pivot point too:

Some of those recruited were a bit wary, understandably:

Some domains were not hiding their intentions:

While most of the entities in these networks are on LinkedIn, some are active on Facebook and even Bluesky:

Stolen credentials and PII of US citizens were used to set up the domains:

In one case, the FBI identified passports sold online as being used in the operation:

The FBI can acquire data from platforms with warrants, which they did with one Gmail address. That address, used in the operation to set up infrastructure, had been connected to from China/HK/Macau a few times and had also had a copy of the operators’ crypto transactions sent to it:

Astoundingly, some of the domains were successful. One illuminative case covers the recruitment of a member of the US military

Other cases also show what China was interested in, unsurprisingly, at that point in time:

We also get a look at some of the recruiting emails sent:

We see Twitter also used, which is a first as far as I remember:

The centrality of Israel and the various ongoing wars in the region astound me:

They of course push them to go for “exclusive” sources:

They can’t seem to get the writing down, and proofreading with ChatGPT or even a local model seems problematic, especially when their recruits push back:

The Centrik domain operated a Linkedin group as well:

This line of effort came off as a little more professional:

It was also more successful, recruiting at least seven targets:

The correspondence is also more convincing:

Some of their content is also similar to Chinese IO efforts, using the “share your thoughts” line to try to garner interaction and engagement:

There’s quite a bit more, but we’ll stop here for now. There are a few conclusions I’d draw from this and other reports on the topic:

• Chinese operations are pervasive and long-term, with some going back to 2023. We can safely assume that they won’t stop.

• The operations are successful and clearly worth it for China. We know this because they keep running them, and now we have confirmation that people with clearances can be successfully recruited.

• Multiple actors in China (presumably different teams in the MSS, though the MPS may also run some) run these. Differing levels of quality and investment are the main indicator here, as well as certain clusters being distinct from others.

• China is interested mainly in the US, but also interested increasingly in other flashpoints and seemingly lacks its own human intelligence assets there.

That’s it for this week, thanks for reading.

This week, we’ll look at some China-centric events. The first is a bit of humblebragging. I’m sure that many of you noticed that the Five Eyes states put on the umpteenth advisory on Chinese virtual espionage on Linkedin. The New Zealand government also confirmed that a few recruitment operations almost took place succesfully:

What’s notable about this one is that it’s a joint, international advisory. China has historically been sensitive to this when it comes to cyber attribution.

Now time for the humblebragging: long-time readers will know that Memetic Warfare is THE place to read about virtual espionage operations targeting the US, Taiwan and abroad, well before they’re covered by mainstream media, in some cases up to a year in advance.

That aside, what’s interesting here to me is how China responded to the event. The Chinese MFA statement put out shortly after uses, I suppose unsurprisingly, the exact same talking points used to counter cyber attribution.

The statement trots out tropes such as the “China (insert field here) threat”, previously used as the “China Cyber Threat” theory in MPS-related publications - see more below.

Other phrases and narratives, such as the “Five Eyes” being in fact the real threat and so on are of course also the same in past MPS and CVERC publications. Even the “thief” sentence is recycled.

I guess it’s just a matter of time until we see similar advisories or reporting from a Chinese cutout or perhaps the MSS itself?

That time is the writing of this blog post. As I was writing this, it seems that Chinese state media already began to lay the groundwork already. On June 7th, the Global Times put out a short piece covering a new MSS statement.

The statement is straightforward, accusing foreign intelligence agencies of using “part-time photography work and paid research assignments” to recruit people in China. The photography is a nice touch, but the paid research assignment is of course the same tactic that China has repeatedly been caught using.

There’s a lot of focus on technical data as part of this to infer performance of weapons systems. The MSS’ advisory as well is detailed, telling citizens to avoid paid gigs and those that request the use of specific equipment, as well as photographing sensitive sites. I liked the use of the phrase “jigsaw-style” intelligence gathering as well:

This is an early and low-effort article, but I imagine that we’ll see more coming out from various Chinese groups as they have time to adapt.

Moving on from that, I wanted to point out NetAskari’s post showing that “BlackTigerAlliance” has posted personal information on the executives of Integrity Tech, a US-sanctioned Chinese cyber company.

Wow, it sure is something how executives and operators from Kaspersky and other Chinese companies just keep getting exposed shortly before or after they’re sanctioned. Life sure is full of coincidences!

The final section today will also be the lengthiest. I wanted to review the indictment against Thomas Weir Pauken II, a US citizen who worked as a journalist for Chinese state outlets and allegedly acted as an asset for the MSS. His indictment was published a while back, and there are some interesting points to review.

Check out the summary below, it’s pretty straightforward.

He was apparently detained in Januaryh 2025 and presumably flipped.

Beyond “Cathy”, Pauken allegedly worked for two others who tried to get him to join the State Department, apparently to no avail.

Pauken was busy selling reports to other Chinese groups, and they even apparently tried to get him to find a contractor to run cyber operations for them.

The attempted flip here is more obvious:

We see Pauken use the typical line in Chinese recruitment: geopolitical consulting.

There are some shenanigans straight out of Curb Your Enthusiasm:

It was also interesting to see that Cathy proposed that he set up a nonprofit to launder payments:

The gendered pronoun redactments made me laugh:

In short, this is an ongoing case and it’s going to be interesting. If Pauken does flip and names names, the fallout would be big for China, and they’d be even further incentivized to double down on a counter campaign - just like they did for cyber.

That’s it for this week, thanks for reading.

I’m sure you’ve all been waiting with baited breath, as have I, to determine whether or not Ababil of Minab was IRGC or MOIS-run.

Your wait has now come to an end thanks to Gambit, which published a report attributing Ababil of Minab to the MOIS, specifically the same group behind Black Shadow. Check out the main points below:

I’ll save you the details, though it’s a pretty concise report, so if you’re interested, give it a read. Having said that - they later targeted the South Florida Regional Transportation Authority by hitting an exposed RDP instance and going from there to live off of the land.

Gambit noticed that Ababil had somehow managed to enroll in Open AI’s security research program! Otherwise, how could they have possibly bypassed ChatGPT’s guardrails to get it to help them with their malware development and scripting? Jokes aside, good catch in the video.

They also use a self-signed certificate, which Iranian threat actors love and we’ll get back to momentarily:

They also apparently are moving into low level languages, doing some dev work in C++. I don’t recall many cases of C++ being used by MOIS threat actors, so that’s a step up:

Gambit attributed the operation to the MOIS by virtue of overlap with past infrastructure, specifically the MOIS-run “nefeshhope” operation:

And to conclude:

Great stuff overall and looking forward to seeing more from Gambit.

We’ll start off with a recommendation. Friend of the blog Greg Davis writes on Latin American affairs at his Substack America and America - see his post on Hondurasgate below:

America and America

Hondurasgate Or Hondurasgate-Gate?

“In 2026 a passable clone costs three minutes in a web interface. The default suspicion should be the opposite of the one pre-digital journalism worked with.” - Hondurasgate.ch editorial policy…

Read more

2 months ago · 3 likes · America and America

Greg’s post also brought to my attention two key factors on the operation. The first is that Honduran media checked out the domain itself and found that its YouTube channel was previously named “Elon Musk Noticias” and used for similar purposes: sharing unverified “conversations” between politicians.

The second component is that Phonexia denied that its tool was ever used by Hondurasgate to verify the audio, meaning that they lied about it (unsurprisingly).

If anyone had any doubts as to whether or not Honduras Gate was a legitimate journalistic venture, the two updates above should have cleared it up.

Moving on, I noticed that Chinese virtual espionage operations continue unabated:

I unfortunately couldn’t find the original email used, and there’s no domain. The Instagram account is still active, and based in China. Despite being ostensibly focused on central Asia, the account’s picture shows the borders of Afghanistan:

The posts are mostly “educational”, but some mention the existence of the company itself - Central Asia Information Consulting Company, claiming to be active in central Asia, China, Singapore and Turkey. The latest post sare from 2024, but they’re still out there cold-emailing apparently.

Beyond the attempts to recruit people, the account uploads the occasional post praising China:

This was a small but interesting and still ongoing operation. The confluence of influence and espionage is something that we see with Iran as well, and I imagine we’ll see more of this going forward from China.

Let’s conclude with a report recommendation from Domaintools Investigations on Doppelganger. Check it out here.

DTI does great work and I’m a big fan of their holistic reporting on these persistent threat actors, which gives context and findings one doesn’t get from a report looking just at one aspect, check out the diagram below as an example.

That’s it for this week, thanks for reading.

This week we’ll take a look at Honduras Gate, a probable influence operation in Latin America brought to my attention by multiple friends of the blog.

The site claims to represent Honduran journalists exposing Israeli and American interference in Latin America, published in collaboration with the far-left Spanish outlet Canal Red.

Canal Red, I’d add, is known for its pro-Russia stance, often “echoing” pro-Russia content and having employed past RT correspondents. Its founder used to collaborate with HispanTV, Iran’s state media outlet in Spanish, as well. In short, I wouldn’t put it past them - knowingly or not - to be a part in a Russian or other influence operation.

Let’s take a look and see what’s happening. I’ll start off by saying that their operational security is good, I didn’t find any solid pivot points to use. For those curious, they use Floki for anonymous hosting, have a Swiss TLD presumably for more privacy, and also use PGP and other privacy-forward methods.

The site itself screams Claude in terms of aesthetics:

The site publishes selected parts of recordings of phone calls. The operators try to confirm their authenticity with Phonexia.

The phone calls themselves are short, sound selectively and arguably overly explicit in many of their admissions. I’ve listened to a few and they sound stilted and edited at best, and in some cases still seem unnatural.

It’s quite possible that the audio is also selectively manipulated as well to fool Phonexia, or that the Phonexia results themselves are fake or misleading. If you want, you can check out the audio clips yourself on the site or on their YouTube channel - I personally was unimpressed.

This is evident in the level of verification provided. By their own admission on many of these clips, characteristics such as “naturalness” are not say 95+ percent there. I’d lean towards manipulation of existing audio or high-quality audio deepfakes as the most probable source of most, if not all, of the audio.

The investigations they’ve published are also super out there in terms of content, just see below. As everyone knows, Honduras is a lynchpin of Israeli foreign policy and national security interests.

Jokes aside, the claims are just ludicrous. How convenient that the president of Honduras says, on a phone call, that the prime minister of Israel had “everything to do with my release” and that Israel funded his campaign?

Guys, Israel has a lot of other things going on at the moment. Honduras is not that important in the grand scheme of things.

Their other “investigations” are also suspicious at best. Their most recent article claims that their site is “under attack” by Israel and the US.

They base this just on alleged “attacks” or “intrusion attempts”.

They claim to geolocate these “attacks” by IP address, showing that they originate in the US and Israel. My brother in Honduras, if the US and Israel wanted to take this site down:

• They could.

• They wouldn’t target it via US or Israel-based hosts.

Their behavior is also telling. In contrast to many legitimate journalists and investigative outlets, they love covering coverage of themselves. They have no qualms retweeting pro-Russia wackjob outlets such as the Grayzone:

Pro-Hizballah Al-Mayadeen:

And of course RT:

They love sharing reactions to their content, including by paragons of virtue like pro-Russia influencer Fiorella Isabel and Evo Morales:

So, let’s review what we have here in bulletpoints. Honduras Gate is a suspicious media outlet that:

• Is tied to pro-Russia outlet Canal Red.

• Amplifies pro-Russia, anti-West content of questionable provenance.

• Is frequently amplified by other far-left and pro-Russia groups groups like the Grayzone and RT, and even some other axis of resistance-aligned groups like al-Mayadeen..

• Possible audio deepfakes or otherwise manipulated audio files. Russia is suspected of having done this a few times, including most effectively in Slovakia.

• Desperately seeks to promote it self and its own media content.

On the whole, I’d call this an influence operation with a pretty high degree of confidence. Hopefully more will come out soon.

That’s it for this week, thanks for reading.

This week’s post is sponsored by Falkor AI. Falkor is an AI-driven investigation hub with a ton of external data integrations, analytics features and more. Check them out at falkor.ai.

We’ll begin with a quick look at the New York Times’ coverage of a Chinese espionage operation targeting the House China Committee.

The article has a lot of interesting points to it, and you should read it. The operation used the guise of Nimbus Hub Consulting, a domain first exposed here on Memetic Warfare:

Nimbus Hub is but one of dozens of domains exposed, so if you’re interested, check out the post above for additional context on the scope of that Chinese operation not covered in the article.

And now for something very similar.

This week’s investigation began with me receiving a job posting sent to me by a friend of the blog. The posting, looking for an awkwardly-phrased “Diplomacy Researcher”, focuses on Israel.

The post offers payment per report on geopolitical affairs, looking for people with experience in Israeli foreign policy and with ties to defense and policy organizations. The contact information includes a UK phone number and a domain, Terra Firma Strategies.

The number itself only has a Signal and WhatsApp account tied to it. Signal is an interesting choice for a company, and the TrueCaller listing is listed as “Securite”, in French, meaning, of course, security in English.

Just by searching the number, email or domain we can find other listings, including the Sahel region, Syria, India and the US, all opened in the past few weeks. They’ve been busy worldwide it seems!

Let’s now check out the domain. They put out geopolitical content, though not a lot of it:

They offer multiple services, but the most relevant is “geopolitical and policy intelligence”:

The about section is sparse, claiming that they were founded in 2025 in the Philippines, but with no information as to personnel.

The site itself has a different number listed on its site and an additional email, with nothing tied to them.:

While ostensibly Phillipines-based, the domain itself has indicators tying it to China. The first is the use of Chinese filenames on uploaded images:

The domain, which runs WordPress, also has a Chinese language pack installed.

Not doing a great job of hiding it here:

Comments should be left in Chinese:

They didn’t shut down the WordPress APIs on the domain also, so we can see that the user account is a burner username:

The domain is a dead end beyond this despite a few other checks. However, they do have a Facebook page which has a ton of additional information:

We can already see that they have other postings on here, including Qatar, as shown above. Iran is also listed:

As are Bangladesh and the Maldives:

Bhutan even gets a shoutout:

The page has also tried to hire an HR assistant in Malaysia with bonuses based on successful recruitment:

The page also tries to juice its engagement numbers, with early posts receiving dozens or 100+ likes or comments. Later posts dropped the fake engagement stats, but the followers - almost all of which are fake Vietnamese or Bangladeshi accounts - show that they paid for a few hundred at least.

The LinkedIn page has a few employees, all of whom seem real. A few appear to be based in the Philippines, and based on the slightly different name, they probably were hired legitimately by whoever is running this operation.

The employees also share postings, including for other regions previously not seen:

Not a ton there, but it is interesting to see that some people were actually roped into this to work on it. That’s a level of investment not usually seen.

So, that aside, why is this interesting? Well, beyond my own personal and abiding interest in the topic, it’s a unique operation.

Firstly, the seemingly Chinese domain is interesting because it targets areas not often seen that are of strategic interest to China.

Secondly, the US and Taiwan have been leading targets, though this domain targets India, Syria, Israel, Iran, Qatar, Bhutan, the Maldives, the Sahel, and other regions, many of which I believe are firsts for China, at least Israel is.

The choices align with an increased Chinese interest in the Middle East due to the ongoing war (check out a blog post from Checkpoint on Chinese cyber espionage targeting Qatar around the same time period) and the need to understand what exactly those pesky Middle-Easterners are up to.

Lastly, the domain uses the Philippines as its listed location. This is in contrast to past domains, which were often based in Hong Kong, Taiwan, Singapore or the US.

The choice of Manila could be due to a few reasons. It’s feasible that Manila seems to be a neutral choice for global recruitment, and it’s also possbile that the domain seeks to avoid detection by adopting a different visage.

A few final words. These domains often seem comical or unserious to outside observers. The NYT article shows that these operations do actively reach out and can even perhaps enjoy some success, though in this case it was quickly foiled. Softer targets than House committees may easily fall for this type of operation, which - not dissimilarly to China’s approach to influence operations - throws some caution to the wind to scale up.

That’s it for this week, thanks for reading.

This week will be a bit lengthier than usual and focus on one of my favorite topics: Chinese cyber attribution.

We’ll start off by checking out a recent article shared with me by a friend of the blog. The article, published by the First Research Institute, a think tank affiliated with the Chinese Ministry of Public Security, focuses on one of my favorite topics: attribution.

The article "A Study and Analysis of the Cognitive Shaping Mechanism of the US’s Construction of the “China Cyber ​​Threat” Narrative” (it’s cut off due to the translation) gets down to business quickly, providing a convenient executive summary in the grey box:

The Chinese love to project in IO, StratComs and cyber attribution, and we see them doing so in one of the first paragraphs. They begin by decrying a variation on the now played-out “China Threat Theory”, coining the phrase “China Cyber Threat”.

They call out the US for having developed a “highly institutionalized policy discourse framework”, which uses “attribution” to provide a “cognitive legitimacy basis for strategic positioning, multilateral sanctions and alliance mobilization”.

While the US of course does use cyber attribution to do the above things that China said - China Cyber Threat aside - China does the exact same things with its own “highly institutionalized policy discourse framework” via the CVERC and other groups. It’s great to see the projection so clearly and to have them really lay down the bullet points for us.

They really give the US a lot of credit for having a coherent, mutlilayered strategy here:

It’s very funny to me that they point out that US attribution relies on three tenets: behavioral pattern attribution, the “narrative of covert technology” (used to explain the lack of samples or evidence) and the presentation of “black box” evidence.

The irony of China saying PCAPs or it didn’t happen shouldn’t be lost on anyone, and is made especially funny by the fact that they essentially make up a term for PCAP, calling them “Packet Capture Approval Files”, instead of just regular Packet Capture files (hence the PCAP).

I’ve been critical of past US advisories and reports not providing enough information, Volt Typhoon being a great example of that. There are realy downsides of not providing them: firstly, it enables China via its menagerie of outfits to put out reporting that tries to debunk the reports. Secondly, it doesn’t really enable industry to take action. Thirdly, it’s boring for me as someone who would kill to pivot off of that data.

The US doesn’t publish enough, but most US partners do, and regardless - US government agencies are trusted and have earned that trust. Industry partners often provide much more detail and are a part of it as well, but the stuff that they don’t provide, presumably to avoid disclosure of sensitive data, is the same logic that China uses to do the same when its organs publish.

The best is yet to come though.

We get to the crux of China’s strategy on cyber attribution of American activity here as they project it quite effectively:

We get this further elaborated below. The article’s description of the US “matrix of government, military, enterprise and media” perfectly mirrors China’s: the MPS and MSS publishing attribution via their own attribution mouthpieces such as the CVERC.

We also see a throwback reference to FISA and previous Volt Typhoon reporting (specifically, report number 3) from the CVERC:

These govenrment outfits collaborate with private industry and use their technical chops as an “endorsement” for the government statements and attribution. The article also targets joint attributions, claiming that their very nature is meant to make them appear more legitimate:

Lastly, the article brings up media outlets as the amplifiers to shape public opinion and broadcast the reports, including adding their ow nadditional selective reporting.

This is all supposed to coalesce into a “self-reinforcing “closed-loop narrative””:

In short, this mirrors China’s approach perfectly as I’ve written about here ad nauseum.

Beyond the stuff we’ve seen before, we see some interesting discussion on the cognitive side. The article claims that the US seeks to generate real impact by “weaving a web of cognition and rules that is difficult to escape from”, centered around three tenets - law, discourse and technology.

The first is the use of “discursive art” to create “cognitive anchors”, for example by using scary codenames like Volt Typhoon to make Chinese threat actors appear intimidating.

The US’ legal strategy is brought up but is a bit garbled:

Lastly we have the technical component, claiming that the US uses technical terminology and classified information to make its attributions appear truthful:

The section concludes here, summarizing the final points of the alleged US approach:

There’s a bit more, but I don’t want to belabor the point.

This was a fascinating look at Chinese perspectives on cyber attribution and cognitive warfare. Not only is it representative of China’s views, it also projects Chin'a’s influence efforts worldwide with its own cyber attribution apparatus.

China’s perspectievs on cyber attribution in that article were made sharper by a new publication from Antiy, one of China’s leading information security companies with an active threat intelligence wing. This was first discussed by Three Buddy Problem, check it out here.

In short, SentinelOne’s Juan Andrés Guerro Saade and Vitaly Kamluk discovered some now ancient malware with some truly fascinating characteristics used against Iran and other targets pre-Stuxnet. Check out the full article here, I’d do it an injustice to further summarize.

Antiy took this and ran with it, publishing a long look at SentinelOne’s analysis, titling SentinelOne’s report “psychological warfare”.

This becomes a bit clearer in the background component, claiming that the “timing and motives behind their publication clearly align with the U.S. side’s efforts to conduct “psychological warfare” in the Middle East.

We’ll now skip a LOT of exposition to get to the interesting components.

We’ll pick up again where Antiy describes their ongoing fight with SentinelOne online. Here we see the same narratives and claims made by the CVERC and other Chinese organs, referring to a post from Guancha on the “Anti-China Chorus” of “U.S. Cybersecurity Think Tanks” that seek to manipualte “anti-China public opinion”. Antiy quotes the article at length, claiming that Dakota Cary of Sentinel One and other figures are responsible for “demonizing” Chinese companies.

It gets more interesting after, where we see that Antiy claims that growth in SentinelOne’s US orders is “highly correlated with teh company’s anti-China actions”. This, of course, is the same thing we see ad nauseum from the CVERC and the Volt Typhoon series.

Enmity between the two aside, the report then moves on to claim that the publication of the report was timed strategically as part of psychological warfare:

The report posits that SnetinelOne is sending a “clear strategic signal” that the US has more cyber capabilities than publicly known. This, of course, should intimidate the adversaries of teh US.

Hysterically, Antiy calls this “spiritual warfare”, stating that it weakens the enemy’s fighting will.

It gets contrived after this, claiming that the report uses intimidating adjective such as “imperceptible” to send a “psychological hint” to adversaries, for some reason calling out Iran especially, that the US has more advanced capabilities.

Antiy also accuses SentinelOne of evading the “fundamental fact” that the FAST16 malware is a “cyberspace operation initiated and led by the U.S. govenrment against the critical infrastructure of a sovereign state”, with “no ethical or international-law-based assessment of this fact”.

SentinelOne did not clearly attribute it as they presumably don’t have enough information to conclusively do so, but it is discussed by one of the authors on the Three Buddy Problem podcast where the US is discussed as the most feasible actor behind it.

This is a clear reach and projection from Antiy, accusing Sentinel One of what they themselves are doing: publishing a biased technical report in service of a political goal.

In typical fashion, this projection is summarized well by the report as a “textbook example of weaponizing technical reports to advance a geopolitical narrative" - building professional credibility through an accumulation of technical details, then using political implications to steer the reader’s value judgments”.

Before we conclude, I’d like to share the new page for my services. If you’re interested in learning more and learning from and/or working with me, just check the link out below.

That’s it for this week, thanks for reading.

I offer research, training and consulting services of all kinds in OSINT, influence and cyber operations, operational security and beyond. I’ve worked with governments, private clients and other organizations worldwide.

While I try my hardest to make most of my training content available here, there simply isn’t a true replacement for in-person training or dedicated research and consulting.

Some of the things I offer:

• Training — Influence operations analysis, cybercrime and cyber threat intelligence analysis, OPSEC for investigators, domain analysis and more. Available in-person or remote.

• Research and investigations — Influence and cyber operations investigation, financial investigation services, and other bespoke OSINT investigations.

• Consulting — Capability assessment and development, methodology reviews, expert witness engagements, and advisory retainers.

If you’re curious about what I have to offer for you and your organization, just let schedule with me on Calendly or reach out at aribenam@memeticwarfare.io.

We’re taking a special and belated look at my latest long-form publication, focusing on a probably Qatar-linked operation. The report is available here.

The report is quite exhaustive, and there’s much more there so give it a read. I’ll go over some highlights, tips and tricks from the report below.

The operation we’re looking at is named “Eekad”. Eekad, a play on the Arabic root for truth. Eekad has been active since 2020 and positions itself, quite succesfully, as the “Arab region’s first open-source intelligence platform”. They’re on Twitter, YouTube, Facebook, Instagram and a semi-active domain.

What makes them interesting is that they pose as an investigative outfit, and use OSINT in a few key verticals:

• Covering influence operations

• Debunking viral content

• Geolocating content

• Social media and other analysis

The genius of this operation is that not only is the Arab world is apparently thirsty for this type of content, it provides a visage of legitimacy and accuracy. The average person can’t really tell whether or not satellite imagery is misrepresented, or if the way that Eekad presents impressive Gephi graphs as proof of an influence operation is in fact accurate.

Eekad has been caught promoting unsupported, misleading, inaccurate or overtly false claims on a number of topics - promoting and defending Qatar, denigrating Israel, Saudi Arabia, the UAE and even the Druze, and promoting the current Syrian government. All of these align with Qatari geopolitical interests.

To get a taste for their type of content - check out below some content claiming to expose networks:

On many cases they visualize different networks than the one above with Gephi to make a point that is otherwise unsupported:

Their emphasis on OSINT is apparent also in their YouTube channel. Open source investigation is their number one videotag. To do this type of analysis yourself, just check out Matt W’s YouTube Metadata bulk here.

Their Facebook page’s transparency section also includes references to Qatar, as well as Turkey (some employees are based there). Most of their ads were paid for in riyals and taken down due to violating Facebook’s political advertising rules. This is a general investigation tip as well - the FB ad library is amazing.

They have an inactive domain at eekad[.]com. However, if you enumerate its subdomains (available with all types of tools), you’ll find a subdomain at facts.eekad[.]com which was inactive for quite a while but at least exposes the original website.

Searching for the domain on Censys exposes one host with Eekad appearing in its HTTP response. This domain belongs to a PR firm, which is hosting a subdomain for Eekad on their own website which hosts an old version of the Eekad domain, showing that they’re tied. So Eekad has some money to throw around for PR firms, which most journalistic outfits of this size don’t.

We’ll conclude with two noteworthy events as well. The first is that Handala set up a domain to solicit information securely from visitors but didn’t bother encrypting the traffic by setting up an SSL cert, which is very funny:

The final thing I’ll point out is Singapore’s takedown of 6 domains seemingly targeting Singapore during its previous election period.

We get some detail below:

The domains are tied to known operations:

See the domains below:

Interesting to see how Singapore handles foreign influence and interference, managing to take down domains without raising the ire of those seemingly responsible.

That’s it for now, thanks for reading.

We’ll start off with a fantastic report from Domaintools Investigations on MOIS cyber and IO operations, with one of the better threat actor names - Moist Grasshopper.

Domaintools Investigations (DTI) consistently puts out some of the best reporting out there. If you’re a reader of Memetic Warfare, you should be a reader of their stuff.

I’d also like to shoutout Domaintools separately from this as well. When I first got started in investigations, I learned a ton from Domaintools’ blog, which would publish detailed investigations and guides. Much of it was an inspiration for what I try to do here.

Back to the report - see below:

The report is way too long for me to cover here and do it justice, but it hits every main point. It gets the structure of the MOIS and their threat actors, and more importantly lays out how they think and work very articulately. Check it out.

From here, we’ll cover more Iran.

I’m not one to usually link to content from the Intercept, but they do occasionally leave me no choice. One of their reporters exposed two covert CENTCOM news domains targeting Iran and Iraq, Pishtaz News and al-Fassel:

The two domains of course promote pro-US and anti-regime narratives, but like previous CENTCOM/contractor IO, they exhibit basic operational security mistakes, like having the sole account they follow be CENTCOM:

Or, even worse, not using a proxy or VPN:

Or, in perhaps the most egregious error yet, hosting a CENTCOM emblem on their domain for some reason:

Weirdly enough, these domains - like previously exposed CENTCOM domains in “Unheard Voices” provide some type of odd disclaimer on the domain itself, which they don’t have on their social media accounts. I honestly can’t think of why CENTCOM feels the need to do this? I can’t imagine the type of regulation requiring them to somehow disclose this.

This is described later in depth, with CENTCOM having changed its disclosures. Time to just drop it guys!

The article notes that the YouTube channel has some overtly AI-generated content:

Despite the effort, the domains’ accounts have essentially no traction:

Moving on, we’ll stay on Iran and take a look at the latest joint US government advisory on Iranian actors targeting critical infrastructure in the US, available here.

They don’t attribute it to Shahid Kaveh/cyb3rav3ngers or the IRGC but do mention how funnily enough that same group was doing the same thing back in the before times of 2023, and we also learn that they apparently hit 75 different devices, an interesting update showing the scale of the activity:

We also see that some of the activity hit government services, water and energy stations and so on, with some experiencing “operational disruption and financial loss”. We also probably had some defacement based on the first paragraph.

The IoC section is more interesting:

What’s interesting about the IP range is it occurs mainly via one AS, and specifically in one CIDR range even. It’s always useful to check sequential IPs, as shown here.

Most of the IP addresses are run by Ultahost, with the one beginning with 135 belonging to M247, a hosting service that we’ve seen exploited by Iran many, many times.

Ultahost has also has been exploited in the past for cyber and influence operations, ranging from Doppelganger to MOIS fronts such as Handala.

Just goes to show you the importance of monitoring problematic ASes.

That’s enough Iran for this week, thanks for reading.

As always, Memetic Warfare guest posts are the sole opinion of their author.

ISNAD that Deep: Persistent Islamist Influence Campaign Targeting Israel Adapts to Iran War

My name is Max Lesser. I work with Ari at the Foundation for Defense of Democracies (FDD). I am sharing research that I conducted in collaboration with my colleague Emmerson Overell and my interns Kellie McSween and Ethan Sheinker.

On March 10, Emma and I published a high-level overview of our findings on over 100 accounts on X that we linked to ISNAD, a persistent Islamist influence campaign that impersonates Israelis with the express intention of destabilizing Israeli society. An Egyptian expat with historical ties to the Muslim brotherhood orchestrates the operation, which crowdsources its participants. The expat, alongside a central management team, reportedly coordinates the participants via Telegram.

We identified 118 accounts that appear to impersonate Israelis, post coordinated paraphrased content, and amplify divisive narratives, including the following: the Israeli Prime Minister is evil; the Israeli government is an undemocratic regime; Israel’s leaders use war to distract the public and preserve power; and internal ‘enemies’—including Haredim, settlers, and the Israeli government—pose a bigger threat to Israel than Hamas or Iran. These tactics, techniques, and procedures (TTPs) and narratives align with reporting on historical ISNAD activity by researchers at Active Info, the HarediLine, the Institute for National Security Studies (INSS), and Fake Reporter, among others.

After the U.S.-Israel war with Iran began on February 28, the network began increasingly incorporating Iran-related narratives, which increased from 3% of the network’s total content before the war to over 20% of its content afterwards.

Impersonating Israelis

Between March 2nd and 9th, all 118 accounts in the network appeared to impersonate Israelis by posting Hebrew-language content speaking from the perspective of Israelis, and sometimes also by explicitly listing their location as Israel. 2 of these accounts, however, were no longer active as of March 30, 2026, i.e., @raphael95yair and @Poorbaby0.

X’s transparency features show that 57 of the accounts had metadata indicating a location outside Israel in either X’s ‘Account Based In’ or ‘Connected Via’ fields. X states that the country or region displayed under ‘About this Account’ is inferred from aggregated IP addresses. X’s ‘Connected Via’ field shows how an account’s user connected to X, which is often via an app store in a specific country or region. Regional app stores associated with this network spanned West Asia, North Africa, Europe, and East Asia, while country-based app stores included Egypt, Morocco, Germany, Iraq, Cyprus, Algeria, Tunisia, Italy, the UAE, and Côte d’Ivoire. Additionally, 68 accounts were marked as based in Israel in the ‘Account Based In’ transparency field. However, X flagged all 68 of these accounts for possible VPN use.

The location metadata described here is based upon observations made between March 2nd and 9th, and may not reflect the current location metadata. Location metadata can change over time when accounts connect in different regions or via different regional proxies, and this metadata can also be spoofed.

Figure: Images of four accounts in the network presenting themselves as Israelis

Figure : X’s transparency feature showing the same four accounts connecting via Android apps associated with Iraq, Morocco, and North Africa.

Coordinated Posting

The incongruity between many of the accounts’ Israeli presentation and their location metadata is a strong indicator of inauthenticity. The network’s posting behavior demonstrates that it is not only inauthentic, but also coordinated. Specifically, the network engages in coordinated posting activity where its accounts consistently post identical or nearly-identical (e.g., slightly paraphrased or rearranged) content.

This analysis collected posts from accounts suspected to be in the network between November 1, 2025 and March 9, 2026. It considered accounts to be part of this network if they engaged in at least one cluster of coordinated content. And so, definitionally, all 116 active accounts participate in at least one coordinated content cluster. In addition, 94 accounts in the network participated in at least 10 clusters; 46 accounts participated in at least 50 clusters; 16 accounts participated in more than 100 clusters; and 5 accounts participated in more than 200 clusters.

Figure: Network visualization of accounts that participated in at least 50 coordinated posting clusters. Node size is proportional to the number of distinct clusters each account participated in. Edge thickness is proportional to the amount of co-participation between two accounts, measured by how often they posted within the same coordinated clusters.

Within the collection period, the network posted 2,274 coordinated content clusters (i.e., content that is either identical or paraphrased and posted by at least two accounts in the network). 1,855 of these clusters were posted by the network 2–4 times; 354 clusters were posted 5–9 times; 50 clusters were posted 10–14 times; 13 clusters were posted 15–19 times; and 2 clusters were posted 20+ times. 1,974 clusters were posted by 2–4 accounts; 260 clusters by 5–9 accounts; 34 clusters by 10–14 accounts; 6 clusters by 15–16 accounts. These numbers demonstrate a high degree of coordinated posting activity across the network.

The largest coordinated content cluster includes Hebrew-language variants of a message stating that Israel is in an existential political crisis, that this crisis is as dangerous as Iran, that the Israeli government is more dangerous than Iran’s regime, and that immediate revolutionary action is necessary to overthrow it. This content was posted 22 times by 16 accounts in the network. Across these posts, the differences are limited to subtle changes in wording, register, and punctuation, while the overall structure and political message remain the same.

Figure: A sample of four posts from the largest coordinated content cluster. @WYylwn41269 and @shatz_david post identical messages while @DanielG_efen and @shera26116 each post slightly paraphrased variants.

A little under half of the network’s posts are replies. Moreover, of 17,589 replies in the dataset, 17,584 (99.97%) target accounts outside the 118-account network, likely to reach external audiences rather than create the impression of engagement with content posted by the network.

In addition to the network’s coordinated posting behavior, the timeline of the accounts’ creation dates are also compressed within a two year timeline. The earliest account in the network was created in May 2024. Over 90% of the accounts were created during or after January 2025, which is the month when Israel and Hamas reached their initial ceasefire agreement. The 2-year compressed timeline provides an additional indicator of coordination, albeit a weaker one than the posting patterns: from a random sample of over 100 authentic accounts, one would expect a broader temporal distribution than two years.

Key Narratives

Multiple key narratives persist throughout the network’s content. The most prevalent narrative demonizes the Israeli Prime Minister, Benjamin Netanyahu, characterizing him as the most pressing threat to Israel. The network’s posts often use words like “Traitor” (בוגד), “Swindler” (נוכל), and “Destroyer” (מחריב) when describing Netanyahu. Posts claim that Netanyahu is responsible for various wars, political decay in Israel, manipulating the public, and the collapse of Israeli institutions. Content posted by the network even includes the claim that Netanyahu has caused more damage to the Jewish people than anyone since Hitler, and that Netanyahu is more dangerous than Iran or Hamas.

Figure: A sample of four posts from a coordinated content cluster that attacks Benjamin Netanyahu.

Another key narrative is that the Israeli government has become a regime or theocracy, with Israel depicted as undergoing either democratic backsliding or collapse. Content communicating this narrative sometimes argues that elections are not a solution, and Israel instead needs revolution or uprising.

Figure: A sample of four posts from a coordinated content cluster depicting the Israeli government as undemocratic and dictatorial.

Another one of the network’s key narratives is that Netanyahu wages wars to preserve his power. Various claims include that the Israeli government is using war to distract the public, suspend elections, or create a permanent state of emergency.

Figure: A sample of four posts from a coordinated content cluster claiming that Netanyahu is waging war against Iran in an attempt to delay elections

Another key narrative frames internal Israeli actors—especially coalition politicians, right-wing ministers, settlers, and Haredi political blocs—as threats from within and, often, as the greatest threat to Israel. Posts frequently claim that these actors pose a greater danger to Israel than Hamas or Iran, with a particular focus on Haredi draft exemptions and the influence of right-wing ministers. Some posts go further, explicitly comparing Israeli politicians to Iran’s rulers, claiming that “there is no difference between the Ayatollahs in Iran and those here.”

Figure: A sample of four posts from a coordinated content cluster framing Haredim and settlers as a threat to Israeli society.

Another recurring narrative portrays the Israeli media as helping manufacture public consent for Netanyahu and for various wars, often using language such as “brainwashing” and “consciousness engineering.”

Figure: A sample of four posts from a coordinated content cluster claiming that the Israeli media is manipulating Israeli public consciousness.

Between the start of Operation Epic Fury (February 28) and the end of the collection period (March 9), the network increasingly leveraged the U.S.-Israeli strikes against Iran in its divisive narratives. These included claims that Netanyahu was using the conflict to preserve power, that people and politicians within Israel posed a greater threat than Iran, and that Israeli coverage of the Iran war was manipulative and propagandistic. As mentioned earlier, Iran-related narratives increased from 3% of all its content before February 28 to over 20% of its content afterwards.

Figure: A sample of four posts from a coordinated content cluster claiming that Iran does not want to eliminate Israelis, but Trump and Netanyahu do.

Attribution

The network appears to be a wing of the persistent Islamist influence campaign known as ISNAD. ISNAD’s TTPs and narratives closely align with those seen in the network discussed in this analysis. Previous TTPs associated with ISNAD include the following: impersonating Israelis on X and other platforms; posting coordinated messages that are slightly paraphrased to avoid detection; and primarily posting replies to authentic Israeli accounts. ISNAD’s narratives exploit divisive political and social topics within Israel, often heavily criticizing the Israeli government. More specific narratives associated with ISNAD include attacking Netanyahu, accusing the Israeli government of failing to protect its citizens, criticizing Haredim and settlers, and occasional calls for uprisings or revolution.

ISNAD’s participants come from regions across the globe including West Asia, North Africa, and Europe, which aligns with the location data of most accounts in the network discussed in this analysis. Additionally, many of the accounts appear to attempt to mask their location with a VPN, which is also a TTP associated with ISNAD.

Given that many of the accounts have metadata on X showing their location is in “Western Asia,” it is possible that there is some Iranian participation in this network. Iranians also have impersonated Israelis in the past. However, nothing specifically indicates Iranian involvement, as this metadata could also be associated with one of over a dozen other West Asian countries. The most plausible attribution of this network is to ISNAD, rather than Iran.

The network’s activity demonstrates how ISNAD’s crowdsourced, “grassroots” influence operations can achieve persistence and rapidly adapt to emerging events to destabilize Israeli society.

Richard Hancock is a threat intelligence researcher at DarkOwl specializing in darknet intelligence, OSINT, and counterterrorism. His work examines how extremist and hybrid threat actors leverage distributed digital ecosystems to shape narratives, manufacture perceived power, and influence real-world outcomes.

As per Richard, rather than emerging as a clearly defined militant organization, Harakat Ashab al-Yamin appears to function as a distributed identity embedded within a broader ecosystem of Iranian-aligned channels. This piece examines how claims, media, and narratives move across platforms, revealing a model where influence is constructed through amplification, reuse, and strategic signaling rather than centralized control.

As always, guest posts on Memetic Warfare are the opinion of their author alone.

Let’s begin.

Harakat Ashab al-Yamin al-Islamia: A New Group or Part of a Broader Iranian-Aligned Network?

A previously unknown group calling itself Harakat Ashab al-Yamin al-Islamia (Ashab al-Yamin) has emerged, claiming responsibility for a series of attacks across Europe and quickly attracting attention from analysts and media outlets. Recent reporting by Long War Journal has documented the group’s increasing tempo of claimed attacks across Europe, noting at least 15 incidents since March. Reporting by CBS News, citing researchers from Tech Against Terrorism and others, has similarly highlighted the group’s sudden appearance and raised questions about whether it represents a genuine operational network or a rapidly assembled media construct linked to broader geopolitical dynamics.

The group’s activity appears largely confined to Telegram, where it publishes a mix of attack claims, propaganda, and geopolitical commentary. Its presence is fragmented, with limited persistent content and much of its activity preserved through secondary or supporter accounts.

Rather than evaluating Ashab al-Yamin as a standalone entity, a closer examination of its Telegram activity suggests a different framing. Patterns of shared content, cross-channel distribution, and overlapping narratives indicate that the group operates within a broader, loosely connected ecosystem of Iranian-aligned channels. This ecosystem overlaps with networks commonly associated with the “Islamic Resistance,” where claims, media, and messaging circulate across multiple accounts rather than originating from a single source.

This raises a central question: is Ashab al-Yamin a distinct organization, or a visible node within a broader networked ecosystem of influence and amplification?

Telegram Activity and Content Patterns

As of early April 2026, the group’s primary Telegram channel, Harakat Ashab al-Yamin al-Islamia, appears to have been removed or banned from the platform. The most recent identifiable content, dated April 4, included a video claiming responsibility for an attack targeting a building associated with Christians for Israel in Nijkerk, Netherlands. While a potential successor channel may exist, no clearly verified or consistently active replacement has been identified at the time of writing, reinforcing the group’s fragmented and unstable presence across Telegram, where continuity appears dependent on redistribution rather than sustained ownership of a single channel.

Since that time, additional content attributed to Ashab al-Yamin has continued to surface across secondary channels, particularly through Sabereen News. Multiple new videos published between April 15 and April 19 claim attacks across European cities, including Munich, London, and North Macedonia. These releases follow a consistent format and narrative framing, reinforcing the pattern of distributed dissemination observed throughout this analysis.

One such example includes a video depicting a purported attack targeting Israeli diplomatic infrastructure in London, featuring hazmat-style protective gear and a small drone bearing Ashab al-Yamin insignia. The use of printed insignia and staged visual elements appears intended to signal authorship and operational credibility, regardless of independently verifiable evidence.

[Screenshot 1& 2: Frames from Ashab al-Yamin video depicting a purported London-based attack, featuring a small drone and hazmat-style protective gear marked with printed insignia, illustrating visual signaling of authorship]

Open-source image hosting platforms have also been observed containing files associated with Ashab al-Yamin insignia, reinforcing the possibility that elements of the group’s visual identity are assembled and distributed through accessible online tools rather than a centralized media apparatus.

[Screenshot 3: Propaganda-style graphic associated with Ashab al-Yamin, combining group insignia with a stylized European cityscape, reinforcing the role of visual media in signaling authorship and amplifying perceived operational reach]

As a result, much of the group’s observable activity is derived from secondary or supporter channels, such as صفي الدين (Safee al-Deen), which continues to circulate attack claims, propaganda, and related content attributed to the group.

Initial review of these channels suggests they do not function solely as claim-of-responsibility outlets. Instead, they operate as hybrid media nodes, combining attack claims, geopolitical commentary, and propagandistic amplification of broader regional narratives.

For example, content includes battlefield or intelligence-style analysis, such as satellite imagery purportedly showing damage to U.S.-linked air facilities in Bahrain and Kuwait following Iranian strikes. The accompanying text describes specific targets such as hangars, fuel storage, and drone infrastructure.

[Screenshot 4: Satellite imagery / strike analysis post]

This style of posting is consistent with content observed across pro-Iranian Telegram channels, where content blends battlefield updates, geopolitical commentary, and narrative amplification alongside claims of responsibility for attacks in Europe.

[Screenshot 5: London ambulance attack claim video]

Another example includes a video documenting an arson attack in London targeting ambulances associated with a Jewish community organization. The accompanying Arabic-language caption frames the incident as an operation carried out by Ashab al-Yamin, referencing a synagogue in the British capital and linking the action to broader anti-Israel narratives.

More recent content attributed to the group includes claims related to an attack targeting a commercial center in Amsterdam. One such post states:

[Screenshot 6: Amsterdam attack video from Ashab al-Yamin]

حركة أصحاب اليمين الإسلامية تتبنى استهداف المركز التجاري العالمي في أمستردام، وتدعو شعوب أوروبا إلى الابتعاد عن المصالح الأمريكية والصهيونية فوراً

Translation:
“The Islamic Movement of Companions of the Right claims responsibility for targeting the World Trade Center in Amsterdam and calls on the peoples of Europe to immediately distance themselves from American and Zionist interests.”

The limited availability of such claims on the group’s official channel, combined with their continued circulation across secondary and affiliated channels, complicates efforts to identify a single point of origin. Instead, messaging is distributed across multiple accounts, where content persists through redistribution rather than consistent publication from a single source.

Content Origination and Cross-Channel Linkages

One particularly notable detail is the presence of Sabereen News branding within video content that was previously reposted by Ashab al-Yamin’s official Telegram channel.

[Screenshot 7: Ashab al-Yamin post showing Sabereen News watermark; London attack]

Sabereen News is a Telegram-based media outlet widely associated with Iranian-aligned networks, with multiple analyses pointing to links with Iran’s Islamic Revolutionary Guard Corps–Qods Force (IRGC-QF) and Iran-backed militia groups. Research by the Washington Institute for Near East Policy notes “strong indicators” of IRGC-QF connections and highlights that the channel first appeared on Telegram in January 2020. More recent reporting from Iran International similarly reflects its position within IRGC-linked messaging networks.

The visible Sabereen News watermark within the footage of the London ambulance attack suggests that the video was either sourced from, or circulated through, an Iranian-aligned media channel prior to being reposted by Ashab al-Yamin. Rather than serving as definitive proof of origin, this overlap indicates participation in a shared media pipeline where content is reused and redistributed across channels.

This interpretation is further supported by activity observed on the Sabereen News channel, which regularly publishes operational updates, threat messaging, and geopolitical narratives aligned with Iranian interests.

[Screenshot 8: Sabereen News missile / strike-related footage]

Additional Sabereen content illustrates this broader narrative environment.

[Screenshots 9 & 10: Sabereen News corporate targeting / company list]

In this example, Sabereen News publishes a list of Western companies, including technology firms, financial institutions, and defense-related entities, framing them as potential targets linked to broader geopolitical events. While this is not a direct claim of responsibility, it reflects a broader pattern of signaling and narrative shaping seen across affiliated channels.

Additional recent content from Sabereen News further illustrates its role as a central distribution node within this ecosystem. In some cases, this aggregation extends beyond Iranian-aligned actors.

For example, Sabereen News has been observed resharing content attributed to Sunni jihadist groups, including material linked to Ajnad Bayt al-Maqdis. The original post appears to have been published by a Telegram account operating under the name “hamid alqawsi,” before being redistributed through Sabereen. The group’s recent pledge of allegiance to al-Qaeda, dated February 2026, coincides with broader regional escalation, reinforcing patterns of opportunistic emergence tied to major geopolitical events. This further illustrates how content moves across distinct networks through centralized amplification channels.

[Screenshots 11 & 12: Original Telegram post from “hamid alqawsi” account and subsequent repost by Sabereen News]

In a separate example, the channel reposts video footage attributed to Hezbollah depicting a missile strike on the Israeli town of Kiryat Shmona. While not directly linked to Ashab al-Yamin, this type of cross-group content aggregation highlights how Sabereen functions as a broader amplification hub, circulating material from multiple actors and reinforcing shared narratives across the network. Channels such as Sabereen News therefore remain key points of observation for tracking how new identities emerge and reappear within this network.

[Screenshot 13: Sabereen News Telegram post reposting Hezbollah-attributed missile strike footage targeting Israel]

An earlier Telegram channel, Haraka Ashab Al Yamin, identified as one of the first to publish content associated with the Amsterdam attack, appears to have been removed or banned from the platform, further complicating efforts to trace content back to a single point of origin.

Across posts, several additional patterns emerge that reinforce this ambiguity. The language is primarily Arabic, with no observable use of Farsi despite speculation of Iranian association, and messaging consistently incorporates anti-Israel and anti-Western themes aligned with broader regional narratives. Taken together, these characteristics further complicate attribution and raise questions about the group’s structure, consistency, and underlying coordination, which become more apparent when examining its claims and media output more closely.

Indicators of Authenticity vs Narrative Construction

The available Telegram content presents a mixed picture of Ashab al-Yamin’s credibility as an operational group. While the channel attempts to project visibility through attack claims and messaging, it lacks several features typically associated with more established militant organizations.

Unlike known Iranian-aligned and PMF-affiliated groups, Ashab al-Yamin does not consistently produce formalized statements, leadership messaging, or a clearly defined media structure. Its presence appears limited in scale, with no clear evidence of sustained or centralized coordination.

At the same time, the quality and style of its media output vary noticeably, with some videos appearing more refined and others more rudimentary. This inconsistency likely reflects contributions from multiple actors rather than a single coordinated media wing.

This aligns with assessments from analysts cited in CBS News, who note that such output may be designed to generate psychological impact rather than demonstrate operational sophistication.

The group’s messaging also closely tracks ongoing geopolitical developments, suggesting a degree of responsiveness and an understanding of how to maximize visibility within a rapidly evolving information environment.

Taken together, these patterns support the interpretation put forward by the Foundation for Defense of Democracies: that Ashab al-Yamin may function less as a centralized organization and more as a front identity used to claim attacks carried out by loosely connected or externally recruited individuals. This ambiguity becomes more meaningful when placed alongside the wider ecosystem in which the group operates.

More broadly, this model reflects a pattern observed across comparable ecosystems, where decentralization, narrative amplification, and perceived reach are often prioritized over formal organizational structure. In such contexts, visibility and attribution can be strategically leveraged to amplify perceived impact without requiring sustained operational capability.

PMF and Iranian-Aligned Telegram Ecosystem

Rather than viewing Ashab al-Yamin in isolation, its activity is better understood within a broader cluster of Telegram channels linked to the “Islamic Resistance” ecosystem. This ecosystem aligns with what is often described as the “Axis of Resistance,” a network of Iranian-aligned state and non-state actors operating across the Middle East and beyond.

This ecosystem includes a mix of militia-linked channels, media outlets, and amplifier accounts. Channels such as:

• شباب الإسلام

• أصحاب الكهف

• جيش الغضب

• صفي الدين

• التعبئة الشعبية للمقاومة الإسلامية في العراق ( بسيج العراق)

• القدرات العسكرية الإيرانية

These channels regularly publish claims, updates, and propaganda tied to attacks against U.S. and allied targets, while also forwarding and resharing content from one another. These channels function as an interconnected network, regularly cross-posting and reinforcing shared narratives.

[Screenshot 14: Safee al-Deen / ecosystem connections post]

Posts such as the above highlight explicit relationships between multiple groups operating under the umbrella of the “Islamic Resistance,” including Ashab al-Kahf and Jaysh al-Ghadab.

Ashab al-Kahf is an Iraqi militia group aligned with the Islamic Resistance in Iraq, known for claiming attacks against U.S. military and allied targets in the region. Its Telegram presence reflects a structured communication style, including consistent branding, formalized statements, and clearly framed claims of responsibility

[Screenshot 15: Ashab al-Kahf Telegram profile / branding insignia]

Jaysh al-Ghadab similarly operates within this ecosystem, publishing claims and messaging tied to attacks and broader resistance narratives. Like Ashab al-Kahf, its content reflects a more established and consistent media presence, with recognizable visual identity and integration into a wider network of affiliated channels.

[Screenshot 16: Jaysh al-Ghadab Telegram profile / branding insignia]

While these groups exhibit more structured branding and communication styles, they operate within the same broader environment as Ashab al-Yamin. Screenshots 17 and 18 illustrate formalized statements published by Ashab al-Kahf and Jaysh al-Ghadab, both of which were subsequently forwarded by the Shabab al-Islam channel. This pattern highlights how official statements originating from more established actors are redistributed across affiliated channels, reinforcing shared narratives, and expanding reach.

[Screenshot 17 & 18: PMF formal statement example]

Both statements follow a consistent format typical of PMF-aligned media output, including religious framing, attribution of attacks against U.S. and Israeli interests, and references to specific operations. For example, one statement claims responsibility for a drone attack targeting Israeli-affiliated infrastructure in Jordan, while emphasizing civilian evacuation warnings and framing the operation within a broader resistance narrative. The second statement similarly adopts formalized language, invoking religious justification, and positioning the attack within the context of ongoing regional conflict. This contrast becomes more apparent when comparing how similar attack-related content appears across different channels within the network.

[Screenshot 19: London ambulance attack claim Ashab al-Yamin TG channel]

[Screenshot 20: London ambulance attack claim: Safee al-Deen TG channel]

Screenshots 19 and 20 show the same London ambulance attack being circulated through Ashab al-Yamin and Safee al-Deen channels, illustrating how identical content is redistributed across different nodes within the network, often with variations in framing and presentation.

These examples illustrate how similar content is circulated, reframed, and redistributed across different channels, reinforcing visibility and narrative consistency.

A Networked Playbook

The emergence of Ashab al-Yamin aligns with a broader pattern seen across similar ecosystems: the rapid creation of new identities designed to claim responsibility, amplify narratives, and generate strategic effects.

Recent analysis by Militant Wire similarly suggests that the group may function less as a traditional organization and more as an “astroturfed” identity embedded within existing Iranian-aligned networks, leveraging low-cost, high-visibility activity to maximize perceived impact.

Rather than representing the development of a traditional, hierarchical organization, this model prioritizes speed, flexibility, and visibility. New entities can quickly establish a presence, insert themselves into ongoing events, and reinforce narratives already circulating across interconnected channels.

As noted in reporting by CBS News, even relatively unsophisticated or ambiguous content can achieve outsized strategic effects. This aligns with analysis from the Foundation for Defense of Democracies, which notes that such models can rely on low-cost, deniable actors and coordinated messaging without requiring a formal organizational structure.

Recent research by the Global Network on Extremism and Technology similarly highlights how digital actors across different ideological and operational backgrounds can converge within shared wartime ecosystems, forming loose networks that amplify common narratives and targets.

These dynamics are not limited to militant media channels. Similar patterns can be observed among pro-Iranian hacktivist groups, which use Telegram to promote alleged data breaches and advertise them on darknet marketplaces. For example, “APT Iran” has claimed to possess stolen data from Lockheed Martin, promoting it through Telegram and advertising it on a Russian-language darknet marketplace known as “Threat Market.”

The listing advertises an estimated value of approximately $374 million, with an exclusive buyout price nearing $600 million, alongside tiered pricing for partial data access. While these figures remain unverified, their scale reflects a broader pattern of inflated valuation and narrative amplification, where the perceived significance of a breach is emphasized as much as the underlying data itself.

[Screenshot 21 & 22: APT Iran Telegram post referencing Lockheed; Lockheed leak posted on Threat Market]

More recent activity suggests increasing instability and responsiveness to external pressure. Following attention surrounding the alleged Lockheed Martin leak, the actor associated with “APT Iran” appears to have changed its Telegram identity to “Brona Blanco” and begun posting images of purported source code tied to the breach. Concurrent messaging in Farsi references potential law enforcement scrutiny, including warnings about FBI targeting of infrastructure linked to Threat Market and the implementation of contingency measures such as a “dead man’s switch.”

[Screenshot 23: APT Iran Telegram post referencing the FBI targeting Threat Market]

[Screenshot 24: APT Iran/Brona Blanco Telegram post referencing Lockheed Martin Source Code]

While these claims remain unverified, this shift in tone and behavior reinforces a consistent pattern observed across these actors: rapid escalation in claims, reactive messaging driven by perceived pressure, and an emphasis on perceived impact over independently verifiable outcomes.

This same dynamic is evident in recent claims by a group calling itself “Ababil of Minab,” which has claimed responsibility for a cyber incident targeting Los Angeles Metro infrastructure. As reported by Dark Web Informer, the group used Telegram to publicize the claim, asserting large-scale data exfiltration and system disruption while providing limited verifiable evidence. While attribution remains unclear, the group’s messaging style and distribution patterns reflect characteristics observed across other Iranian-aligned or Iran-affiliated cyber personas.

[Screenshot 25: “Ababil of Minab” Telegram posts claiming responsibility for a cyber intrusion targeting LA Metro]

As with other actors in this ecosystem, the framing of the operation emphasizes scale and impact, including claims of hundreds of terabytes of data being wiped and additional sensitive data extracted. This reflects a recurring dynamic in which perceived significance is amplified through messaging rather than confirmed technical outcomes.

This interpretation is consistent with emerging reporting on Iran-linked hybrid activity, where analysts have noted coordinated behavior across pro-Iranian digital ecosystems and raised questions about the authenticity of some groups operating within them.

Conclusion

Harakat Ashab al-Yamin al-Islamia has emerged rapidly, but its fragmented Telegram presence, recycled media, and overlap with Iranian-aligned channels complicate its assessment as a standalone organization.

Instead, it is best understood as part of a broader ecosystem in which content is circulated, repurposed, and reinforced across multiple actors. In this environment, attribution becomes less about identifying a single origin point and more about understanding how narratives move and gain traction across interconnected channels.

This model allows new entities to project visibility and claim relevance without demonstrating sustained operational capability, blurring the line between coordinated activity and opportunistic amplification.

As this environment evolves, tracking how new entities emerge, gain visibility, and integrate into existing ecosystems will remain critical to understanding how influence is constructed and projected.

It all began a bit over a week ago when LA’s metro authority confirmed that it was popped.

The intrusion only led to some noncritical systems being taken down, and service wasn’t disrupted meaningfully. An Iranian group took credit for the operation, and Dataminr was the first to report it.

The name itself is a reference to the Quran, with the ababil itself meaning a “flock”. This isn’t just any flock, but a specific one referred to in the Quran as having protected Mecca from an invading army. The reference to Minab is to the school bombed by the US in the Israel/US-Iran war, which has turned into a trope of Iranian propaganda.

Most of the overtly Islamic references I’ve seen in fronts have been related to ASA, but there have been others, as well as other bird-brained Iranian/Hizballah related operations.

You can see the logo and aesthetics clearly here:

They’ve had two main targets so far. The most recent is Vyncs, a GPS company, which they hit with a defacement on April 11th:

They include screenshots of the company’s SQL database and other internal systems:

Their first operation, as stated, was against Metro.net, LA county’s transit authority:

They managed to get in to their VMWare environment:

From there, they manually deleted clusters and uploaded some footage from street cameras:

They also gained access to some OT infrastructure, in this case managing a rail yard:

They even engage in real memery, which is something you don’t often see from the front groups themselves, and is more the type of thing I’d expect from Mr. Soul/cyberav3ngers and less from ASA or even the MOIS.

Jokes aside, their opsec isn’t perfect. They expose a TLS certificate for the host that points to the domain, which Validin picks up below, exposing the true host, despite it being behind Cloudflare.

We also see two identical domains registered on different TLDs on Cloudflare - just like the IRGC espionage operation from last week.

Despite being hosted on Cloudflare, the domain was registered on Ultahost - a registrar and hosting provider we’ve seen used by Iran multiple times in the past weeks:

The host just exposes a default Apache (one of the most common web server) homepages.

Trying to connect to the host on port 443 for HTTP (to see if the domain is hosted on the site still) gets a refusal as I lack a client certificate.

This means that they’ve locked down the ability to connect to the site hosted on the server directly, which is better operational security than we’re used to seeing, even though they messed up with the host TLS certificate.

This is especially odd considering that some of their links lead to open directories?

The domain is otherwise uninteresting, no favicon results, interesting SOA or DNS records or otherwise.

We also have some interesting post op activity. They operators seem to be running a burner, impersonating a customer responding to a tweet from Vyncs and referring to the domain:

This screams ASA to me, as it’s the type of thing they do and less for say cyberav3ngers/APT IRAN.

As stated earlier, they started off with a Telegram channel and Twitter account. The Telegram channel is already shadowbanned, and the Twitter account has been taken down.

Like past ASA operations, they do have backups ready to go on Twitter:

We also have an Arabic-language Twitter account which is still active. This is the type of thing that ASA does, they often run fronts in Arabic which we see less of from other groups:

This one is a fun one attribution-wise.

• Actual intrusion into critical infrastructure. Leans more towards IRGC (Cyberav3ngers or ASA), though could be MOIS

• Prepositioned backups ready to go on Twitter, something ASA has done, though other MOIS orgs have also (Handala in particular)

• Use of Cloudflare - past IRGC operations, higher value

• Islamic-language and aesthetics, similar to ASA

• Running the operation partially in Arabic, points to ASA

• Targeting US critical infrastructure, but seemingly for real (at least to some degree) similar to IRGC actors like APT Iran/CyberAv3ngers, ASA

• Running additional entities beyond the main accounts - most commonly seen with ASA and IRGC actors but also done occasionally by MOIS actors

• Registering two domains on Cloudflare simultaneously like last week’s IRGC spying operation. This means this is a higher-investment operation and I can’t recall many cases when the MOIS used Cloudflare, but I could be wrong.

• Tighter OpSec than most MOIS operations

I’m inclined to believe that this is IRGC-related and not MOIS due to the above points.

The question there is, ASA or Cyberav3ngers/APT-Iran?

This one is a bit less clear, but if I absolutely had to guess, I’d lean towards ASA due to the specific TTPs - creating a new, higher-investment front with Islamic branding, but it could just as easily be cyberav3ngers or any other IRGC-related group (memery, timeline etc) or even the MOIS.

That’s it for this week, thanks for reading.