When it rains, it pours. This emergency post is going to review, in-depth, the latest FBI affidavit exposing 13 Chinese virtual espionage domains.

Open AI also released a report on Chinese IO targeting data centers, which we will review in a later post.

Let’s dive right in. The FBI and DOJ announced a takedown of 13 Chinese virtual espionage domains, with the announcement and affidavit available here.

The affidavit is lengthy so we’ll focus on the key points.

The summary is straightforward:

By virtue of this being an FBI indictment, we get some information we don’t usually get just from open sources, such as their use of identity theft and information on correspondence between the handlers and those targeted:

LinkedIn, as well as multiple freelancing platforms, are mentioned as key hubs of activity:

Paypal and crypto are the main methods of payment:

The domains seized are listed:

The domains are interesting in that they’re more dispersed geographically than we usually see, with companies based in Europe and the Middle East - not just Taiwan, Hong Kong and Singapore:

Some of these are a bit older and frankly unimpressive:

We’ll skip ahead to their analysis of the domains. While there’s still much to be desired, the affidavit actually provides indicators and basic analysis of the domains. I’d call this a big step forward for FBI affidavits.

We see that the FBI relies on a few overly basic indicators, such as sharing a host server (and its affiliated IP address), without including more advanced domain analysis techniques. Hopefully we’ll see more of that soon. That aside, the FBI relies heavily on other heuristics, such as job text similarity, vagueness, stock photos and so on which we’re used to relying on here. In only a few cases are other indicators, such as impersonation, use of stolen identities or so on are brought up, and only three were the result of reports to the FBI.

We’re also lucky enough to get analysis of each domain. We won’t cover every single one, but there are some points to review. Firstly, the reliance on stolen credentials for individuals is interesting, with the operators relying on exposed credentials and information on US citizens to set up the infrastructure:

They use stock images - of course:

The operators have a sense of humor, which I appreciate greatly. Make espionage funny again.

Many of the domains go back at least 2 and sometimes 3 years. As we’ve shown on Memetic Warfare, Chinese espionage has also expanded to covering the Middle East and other “international hotspot” issues:

Many such cases of this:

Unique text is always a good pivot point too:

Some of those recruited were a bit wary, understandably:

Some domains were not hiding their intentions:

While most of the entities in these networks are on LinkedIn, some are active on Facebook and even Bluesky:

Stolen credentials and PII of US citizens were used to set up the domains:

In one case, the FBI identified passports sold online as being used in the operation:

The FBI can acquire data from platforms with warrants, which they did with one Gmail address. That address, used in the operation to set up infrastructure, had been connected to from China/HK/Macau a few times and had also had a copy of the operators’ crypto transactions sent to it:

Astoundingly, some of the domains were successful. One illuminative case covers the recruitment of a member of the US military

Other cases also show what China was interested in, unsurprisingly, at that point in time:

We also get a look at some of the recruiting emails sent:

We see Twitter also used, which is a first as far as I remember:

The centrality of Israel and the various ongoing wars in the region astound me:

They of course push them to go for “exclusive” sources:

They can’t seem to get the writing down, and proofreading with ChatGPT or even a local model seems problematic, especially when their recruits push back:

The Centrik domain operated a Linkedin group as well:

This line of effort came off as a little more professional:

It was also more successful, recruiting at least seven targets:

The correspondence is also more convincing:

Some of their content is also similar to Chinese IO efforts, using the “share your thoughts” line to try to garner interaction and engagement:

There’s quite a bit more, but we’ll stop here for now. There are a few conclusions I’d draw from this and other reports on the topic:

• Chinese operations are pervasive and long-term, with some going back to 2023. We can safely assume that they won’t stop.

• The operations are successful and clearly worth it for China. We know this because they keep running them, and now we have confirmation that people with clearances can be successfully recruited.

• Multiple actors in China (presumably different teams in the MSS, though the MPS may also run some) run these. Differing levels of quality and investment are the main indicator here, as well as certain clusters being distinct from others.

• China is interested mainly in the US, but also interested increasingly in other flashpoints and seemingly lacks its own human intelligence assets there.

That’s it for this week, thanks for reading.

This week, we’ll look at some China-centric events. The first is a bit of humblebragging. I’m sure that many of you noticed that the Five Eyes states put on the umpteenth advisory on Chinese virtual espionage on Linkedin. The New Zealand government also confirmed that a few recruitment operations almost took place succesfully:

What’s notable about this one is that it’s a joint, international advisory. China has historically been sensitive to this when it comes to cyber attribution.

Now time for the humblebragging: long-time readers will know that Memetic Warfare is THE place to read about virtual espionage operations targeting the US, Taiwan and abroad, well before they’re covered by mainstream media, in some cases up to a year in advance.

That aside, what’s interesting here to me is how China responded to the event. The Chinese MFA statement put out shortly after uses, I suppose unsurprisingly, the exact same talking points used to counter cyber attribution.

The statement trots out tropes such as the “China (insert field here) threat”, previously used as the “China Cyber Threat” theory in MPS-related publications - see more below.

Other phrases and narratives, such as the “Five Eyes” being in fact the real threat and so on are of course also the same in past MPS and CVERC publications. Even the “thief” sentence is recycled.

I guess it’s just a matter of time until we see similar advisories or reporting from a Chinese cutout or perhaps the MSS itself?

That time is the writing of this blog post. As I was writing this, it seems that Chinese state media already began to lay the groundwork already. On June 7th, the Global Times put out a short piece covering a new MSS statement.

The statement is straightforward, accusing foreign intelligence agencies of using “part-time photography work and paid research assignments” to recruit people in China. The photography is a nice touch, but the paid research assignment is of course the same tactic that China has repeatedly been caught using.

There’s a lot of focus on technical data as part of this to infer performance of weapons systems. The MSS’ advisory as well is detailed, telling citizens to avoid paid gigs and those that request the use of specific equipment, as well as photographing sensitive sites. I liked the use of the phrase “jigsaw-style” intelligence gathering as well:

This is an early and low-effort article, but I imagine that we’ll see more coming out from various Chinese groups as they have time to adapt.

Moving on from that, I wanted to point out NetAskari’s post showing that “BlackTigerAlliance” has posted personal information on the executives of Integrity Tech, a US-sanctioned Chinese cyber company.

Wow, it sure is something how executives and operators from Kaspersky and other Chinese companies just keep getting exposed shortly before or after they’re sanctioned. Life sure is full of coincidences!

The final section today will also be the lengthiest. I wanted to review the indictment against Thomas Weir Pauken II, a US citizen who worked as a journalist for Chinese state outlets and allegedly acted as an asset for the MSS. His indictment was published a while back, and there are some interesting points to review.

Check out the summary below, it’s pretty straightforward.

He was apparently detained in Januaryh 2025 and presumably flipped.

Beyond “Cathy”, Pauken allegedly worked for two others who tried to get him to join the State Department, apparently to no avail.

Pauken was busy selling reports to other Chinese groups, and they even apparently tried to get him to find a contractor to run cyber operations for them.

The attempted flip here is more obvious:

We see Pauken use the typical line in Chinese recruitment: geopolitical consulting.

There are some shenanigans straight out of Curb Your Enthusiasm:

It was also interesting to see that Cathy proposed that he set up a nonprofit to launder payments:

The gendered pronoun redactments made me laugh:

In short, this is an ongoing case and it’s going to be interesting. If Pauken does flip and names names, the fallout would be big for China, and they’d be even further incentivized to double down on a counter campaign - just like they did for cyber.

That’s it for this week, thanks for reading.

I’m sure you’ve all been waiting with baited breath, as have I, to determine whether or not Ababil of Minab was IRGC or MOIS-run.

Your wait has now come to an end thanks to Gambit, which published a report attributing Ababil of Minab to the MOIS, specifically the same group behind Black Shadow. Check out the main points below:

I’ll save you the details, though it’s a pretty concise report, so if you’re interested, give it a read. Having said that - they later targeted the South Florida Regional Transportation Authority by hitting an exposed RDP instance and going from there to live off of the land.

Gambit noticed that Ababil had somehow managed to enroll in Open AI’s security research program! Otherwise, how could they have possibly bypassed ChatGPT’s guardrails to get it to help them with their malware development and scripting? Jokes aside, good catch in the video.

They also use a self-signed certificate, which Iranian threat actors love and we’ll get back to momentarily:

They also apparently are moving into low level languages, doing some dev work in C++. I don’t recall many cases of C++ being used by MOIS threat actors, so that’s a step up:

Gambit attributed the operation to the MOIS by virtue of overlap with past infrastructure, specifically the MOIS-run “nefeshhope” operation:

And to conclude:

Great stuff overall and looking forward to seeing more from Gambit.

We’ll start off with a recommendation. Friend of the blog Greg Davis writes on Latin American affairs at his Substack America and America - see his post on Hondurasgate below:

America and America

Hondurasgate Or Hondurasgate-Gate?

“In 2026 a passable clone costs three minutes in a web interface. The default suspicion should be the opposite of the one pre-digital journalism worked with.” - Hondurasgate.ch editorial policy…

Read more

24 days ago · 3 likes · America and America

Greg’s post also brought to my attention two key factors on the operation. The first is that Honduran media checked out the domain itself and found that its YouTube channel was previously named “Elon Musk Noticias” and used for similar purposes: sharing unverified “conversations” between politicians.

The second component is that Phonexia denied that its tool was ever used by Hondurasgate to verify the audio, meaning that they lied about it (unsurprisingly).

If anyone had any doubts as to whether or not Honduras Gate was a legitimate journalistic venture, the two updates above should have cleared it up.

Moving on, I noticed that Chinese virtual espionage operations continue unabated:

I unfortunately couldn’t find the original email used, and there’s no domain. The Instagram account is still active, and based in China. Despite being ostensibly focused on central Asia, the account’s picture shows the borders of Afghanistan:

The posts are mostly “educational”, but some mention the existence of the company itself - Central Asia Information Consulting Company, claiming to be active in central Asia, China, Singapore and Turkey. The latest post sare from 2024, but they’re still out there cold-emailing apparently.

Beyond the attempts to recruit people, the account uploads the occasional post praising China:

This was a small but interesting and still ongoing operation. The confluence of influence and espionage is something that we see with Iran as well, and I imagine we’ll see more of this going forward from China.

Let’s conclude with a report recommendation from Domaintools Investigations on Doppelganger. Check it out here.

DTI does great work and I’m a big fan of their holistic reporting on these persistent threat actors, which gives context and findings one doesn’t get from a report looking just at one aspect, check out the diagram below as an example.

That’s it for this week, thanks for reading.

This week we’ll take a look at Honduras Gate, a probable influence operation in Latin America brought to my attention by multiple friends of the blog.

The site claims to represent Honduran journalists exposing Israeli and American interference in Latin America, published in collaboration with the far-left Spanish outlet Canal Red.

Canal Red, I’d add, is known for its pro-Russia stance, often “echoing” pro-Russia content and having employed past RT correspondents. Its founder used to collaborate with HispanTV, Iran’s state media outlet in Spanish, as well. In short, I wouldn’t put it past them - knowingly or not - to be a part in a Russian or other influence operation.

Let’s take a look and see what’s happening. I’ll start off by saying that their operational security is good, I didn’t find any solid pivot points to use. For those curious, they use Floki for anonymous hosting, have a Swiss TLD presumably for more privacy, and also use PGP and other privacy-forward methods.

The site itself screams Claude in terms of aesthetics:

The site publishes selected parts of recordings of phone calls. The operators try to confirm their authenticity with Phonexia.

The phone calls themselves are short, sound selectively and arguably overly explicit in many of their admissions. I’ve listened to a few and they sound stilted and edited at best, and in some cases still seem unnatural.

It’s quite possible that the audio is also selectively manipulated as well to fool Phonexia, or that the Phonexia results themselves are fake or misleading. If you want, you can check out the audio clips yourself on the site or on their YouTube channel - I personally was unimpressed.

This is evident in the level of verification provided. By their own admission on many of these clips, characteristics such as “naturalness” are not say 95+ percent there. I’d lean towards manipulation of existing audio or high-quality audio deepfakes as the most probable source of most, if not all, of the audio.

The investigations they’ve published are also super out there in terms of content, just see below. As everyone knows, Honduras is a lynchpin of Israeli foreign policy and national security interests.

Jokes aside, the claims are just ludicrous. How convenient that the president of Honduras says, on a phone call, that the prime minister of Israel had “everything to do with my release” and that Israel funded his campaign?

Guys, Israel has a lot of other things going on at the moment. Honduras is not that important in the grand scheme of things.

Their other “investigations” are also suspicious at best. Their most recent article claims that their site is “under attack” by Israel and the US.

They base this just on alleged “attacks” or “intrusion attempts”.

They claim to geolocate these “attacks” by IP address, showing that they originate in the US and Israel. My brother in Honduras, if the US and Israel wanted to take this site down:

• They could.

• They wouldn’t target it via US or Israel-based hosts.

Their behavior is also telling. In contrast to many legitimate journalists and investigative outlets, they love covering coverage of themselves. They have no qualms retweeting pro-Russia wackjob outlets such as the Grayzone:

Pro-Hizballah Al-Mayadeen:

And of course RT:

They love sharing reactions to their content, including by paragons of virtue like pro-Russia influencer Fiorella Isabel and Evo Morales:

So, let’s review what we have here in bulletpoints. Honduras Gate is a suspicious media outlet that:

• Is tied to pro-Russia outlet Canal Red.

• Amplifies pro-Russia, anti-West content of questionable provenance.

• Is frequently amplified by other far-left and pro-Russia groups groups like the Grayzone and RT, and even some other axis of resistance-aligned groups like al-Mayadeen..

• Possible audio deepfakes or otherwise manipulated audio files. Russia is suspected of having done this a few times, including most effectively in Slovakia.

• Desperately seeks to promote it self and its own media content.

On the whole, I’d call this an influence operation with a pretty high degree of confidence. Hopefully more will come out soon.

That’s it for this week, thanks for reading.

This week’s post is sponsored by Falkor AI. Falkor is an AI-driven investigation hub with a ton of external data integrations, analytics features and more. Check them out at falkor.ai.

We’ll begin with a quick look at the New York Times’ coverage of a Chinese espionage operation targeting the House China Committee.

The article has a lot of interesting points to it, and you should read it. The operation used the guise of Nimbus Hub Consulting, a domain first exposed here on Memetic Warfare:

Nimbus Hub is but one of dozens of domains exposed, so if you’re interested, check out the post above for additional context on the scope of that Chinese operation not covered in the article.

And now for something very similar.

This week’s investigation began with me receiving a job posting sent to me by a friend of the blog. The posting, looking for an awkwardly-phrased “Diplomacy Researcher”, focuses on Israel.

The post offers payment per report on geopolitical affairs, looking for people with experience in Israeli foreign policy and with ties to defense and policy organizations. The contact information includes a UK phone number and a domain, Terra Firma Strategies.

The number itself only has a Signal and WhatsApp account tied to it. Signal is an interesting choice for a company, and the TrueCaller listing is listed as “Securite”, in French, meaning, of course, security in English.

Just by searching the number, email or domain we can find other listings, including the Sahel region, Syria, India and the US, all opened in the past few weeks. They’ve been busy worldwide it seems!

Let’s now check out the domain. They put out geopolitical content, though not a lot of it:

They offer multiple services, but the most relevant is “geopolitical and policy intelligence”:

The about section is sparse, claiming that they were founded in 2025 in the Philippines, but with no information as to personnel.

The site itself has a different number listed on its site and an additional email, with nothing tied to them.:

While ostensibly Phillipines-based, the domain itself has indicators tying it to China. The first is the use of Chinese filenames on uploaded images:

The domain, which runs WordPress, also has a Chinese language pack installed.

Not doing a great job of hiding it here:

Comments should be left in Chinese:

They didn’t shut down the WordPress APIs on the domain also, so we can see that the user account is a burner username:

The domain is a dead end beyond this despite a few other checks. However, they do have a Facebook page which has a ton of additional information:

We can already see that they have other postings on here, including Qatar, as shown above. Iran is also listed:

As are Bangladesh and the Maldives:

Bhutan even gets a shoutout:

The page has also tried to hire an HR assistant in Malaysia with bonuses based on successful recruitment:

The page also tries to juice its engagement numbers, with early posts receiving dozens or 100+ likes or comments. Later posts dropped the fake engagement stats, but the followers - almost all of which are fake Vietnamese or Bangladeshi accounts - show that they paid for a few hundred at least.

The LinkedIn page has a few employees, all of whom seem real. A few appear to be based in the Philippines, and based on the slightly different name, they probably were hired legitimately by whoever is running this operation.

The employees also share postings, including for other regions previously not seen:

Not a ton there, but it is interesting to see that some people were actually roped into this to work on it. That’s a level of investment not usually seen.

So, that aside, why is this interesting? Well, beyond my own personal and abiding interest in the topic, it’s a unique operation.

Firstly, the seemingly Chinese domain is interesting because it targets areas not often seen that are of strategic interest to China.

Secondly, the US and Taiwan have been leading targets, though this domain targets India, Syria, Israel, Iran, Qatar, Bhutan, the Maldives, the Sahel, and other regions, many of which I believe are firsts for China, at least Israel is.

The choices align with an increased Chinese interest in the Middle East due to the ongoing war (check out a blog post from Checkpoint on Chinese cyber espionage targeting Qatar around the same time period) and the need to understand what exactly those pesky Middle-Easterners are up to.

Lastly, the domain uses the Philippines as its listed location. This is in contrast to past domains, which were often based in Hong Kong, Taiwan, Singapore or the US.

The choice of Manila could be due to a few reasons. It’s feasible that Manila seems to be a neutral choice for global recruitment, and it’s also possbile that the domain seeks to avoid detection by adopting a different visage.

A few final words. These domains often seem comical or unserious to outside observers. The NYT article shows that these operations do actively reach out and can even perhaps enjoy some success, though in this case it was quickly foiled. Softer targets than House committees may easily fall for this type of operation, which - not dissimilarly to China’s approach to influence operations - throws some caution to the wind to scale up.

That’s it for this week, thanks for reading.

This week will be a bit lengthier than usual and focus on one of my favorite topics: Chinese cyber attribution.

We’ll start off by checking out a recent article shared with me by a friend of the blog. The article, published by the First Research Institute, a think tank affiliated with the Chinese Ministry of Public Security, focuses on one of my favorite topics: attribution.

The article "A Study and Analysis of the Cognitive Shaping Mechanism of the US’s Construction of the “China Cyber ​​Threat” Narrative” (it’s cut off due to the translation) gets down to business quickly, providing a convenient executive summary in the grey box:

The Chinese love to project in IO, StratComs and cyber attribution, and we see them doing so in one of the first paragraphs. They begin by decrying a variation on the now played-out “China Threat Theory”, coining the phrase “China Cyber Threat”.

They call out the US for having developed a “highly institutionalized policy discourse framework”, which uses “attribution” to provide a “cognitive legitimacy basis for strategic positioning, multilateral sanctions and alliance mobilization”.

While the US of course does use cyber attribution to do the above things that China said - China Cyber Threat aside - China does the exact same things with its own “highly institutionalized policy discourse framework” via the CVERC and other groups. It’s great to see the projection so clearly and to have them really lay down the bullet points for us.

They really give the US a lot of credit for having a coherent, mutlilayered strategy here:

It’s very funny to me that they point out that US attribution relies on three tenets: behavioral pattern attribution, the “narrative of covert technology” (used to explain the lack of samples or evidence) and the presentation of “black box” evidence.

The irony of China saying PCAPs or it didn’t happen shouldn’t be lost on anyone, and is made especially funny by the fact that they essentially make up a term for PCAP, calling them “Packet Capture Approval Files”, instead of just regular Packet Capture files (hence the PCAP).

I’ve been critical of past US advisories and reports not providing enough information, Volt Typhoon being a great example of that. There are realy downsides of not providing them: firstly, it enables China via its menagerie of outfits to put out reporting that tries to debunk the reports. Secondly, it doesn’t really enable industry to take action. Thirdly, it’s boring for me as someone who would kill to pivot off of that data.

The US doesn’t publish enough, but most US partners do, and regardless - US government agencies are trusted and have earned that trust. Industry partners often provide much more detail and are a part of it as well, but the stuff that they don’t provide, presumably to avoid disclosure of sensitive data, is the same logic that China uses to do the same when its organs publish.

The best is yet to come though.

We get to the crux of China’s strategy on cyber attribution of American activity here as they project it quite effectively:

We get this further elaborated below. The article’s description of the US “matrix of government, military, enterprise and media” perfectly mirrors China’s: the MPS and MSS publishing attribution via their own attribution mouthpieces such as the CVERC.

We also see a throwback reference to FISA and previous Volt Typhoon reporting (specifically, report number 3) from the CVERC:

These govenrment outfits collaborate with private industry and use their technical chops as an “endorsement” for the government statements and attribution. The article also targets joint attributions, claiming that their very nature is meant to make them appear more legitimate:

Lastly, the article brings up media outlets as the amplifiers to shape public opinion and broadcast the reports, including adding their ow nadditional selective reporting.

This is all supposed to coalesce into a “self-reinforcing “closed-loop narrative””:

In short, this mirrors China’s approach perfectly as I’ve written about here ad nauseum.

Beyond the stuff we’ve seen before, we see some interesting discussion on the cognitive side. The article claims that the US seeks to generate real impact by “weaving a web of cognition and rules that is difficult to escape from”, centered around three tenets - law, discourse and technology.

The first is the use of “discursive art” to create “cognitive anchors”, for example by using scary codenames like Volt Typhoon to make Chinese threat actors appear intimidating.

The US’ legal strategy is brought up but is a bit garbled:

Lastly we have the technical component, claiming that the US uses technical terminology and classified information to make its attributions appear truthful:

The section concludes here, summarizing the final points of the alleged US approach:

There’s a bit more, but I don’t want to belabor the point.

This was a fascinating look at Chinese perspectives on cyber attribution and cognitive warfare. Not only is it representative of China’s views, it also projects Chin'a’s influence efforts worldwide with its own cyber attribution apparatus.

China’s perspectievs on cyber attribution in that article were made sharper by a new publication from Antiy, one of China’s leading information security companies with an active threat intelligence wing. This was first discussed by Three Buddy Problem, check it out here.

In short, SentinelOne’s Juan Andrés Guerro Saade and Vitaly Kamluk discovered some now ancient malware with some truly fascinating characteristics used against Iran and other targets pre-Stuxnet. Check out the full article here, I’d do it an injustice to further summarize.

Antiy took this and ran with it, publishing a long look at SentinelOne’s analysis, titling SentinelOne’s report “psychological warfare”.

This becomes a bit clearer in the background component, claiming that the “timing and motives behind their publication clearly align with the U.S. side’s efforts to conduct “psychological warfare” in the Middle East.

We’ll now skip a LOT of exposition to get to the interesting components.

We’ll pick up again where Antiy describes their ongoing fight with SentinelOne online. Here we see the same narratives and claims made by the CVERC and other Chinese organs, referring to a post from Guancha on the “Anti-China Chorus” of “U.S. Cybersecurity Think Tanks” that seek to manipualte “anti-China public opinion”. Antiy quotes the article at length, claiming that Dakota Cary of Sentinel One and other figures are responsible for “demonizing” Chinese companies.

It gets more interesting after, where we see that Antiy claims that growth in SentinelOne’s US orders is “highly correlated with teh company’s anti-China actions”. This, of course, is the same thing we see ad nauseum from the CVERC and the Volt Typhoon series.

Enmity between the two aside, the report then moves on to claim that the publication of the report was timed strategically as part of psychological warfare:

The report posits that SnetinelOne is sending a “clear strategic signal” that the US has more cyber capabilities than publicly known. This, of course, should intimidate the adversaries of teh US.

Hysterically, Antiy calls this “spiritual warfare”, stating that it weakens the enemy’s fighting will.

It gets contrived after this, claiming that the report uses intimidating adjective such as “imperceptible” to send a “psychological hint” to adversaries, for some reason calling out Iran especially, that the US has more advanced capabilities.

Antiy also accuses SentinelOne of evading the “fundamental fact” that the FAST16 malware is a “cyberspace operation initiated and led by the U.S. govenrment against the critical infrastructure of a sovereign state”, with “no ethical or international-law-based assessment of this fact”.

SentinelOne did not clearly attribute it as they presumably don’t have enough information to conclusively do so, but it is discussed by one of the authors on the Three Buddy Problem podcast where the US is discussed as the most feasible actor behind it.

This is a clear reach and projection from Antiy, accusing Sentinel One of what they themselves are doing: publishing a biased technical report in service of a political goal.

In typical fashion, this projection is summarized well by the report as a “textbook example of weaponizing technical reports to advance a geopolitical narrative" - building professional credibility through an accumulation of technical details, then using political implications to steer the reader’s value judgments”.

Before we conclude, I’d like to share the new page for my services. If you’re interested in learning more and learning from and/or working with me, just check the link out below.

That’s it for this week, thanks for reading.

I offer research, training and consulting services of all kinds in OSINT, influence and cyber operations, operational security and beyond. I’ve worked with governments, private clients and other organizations worldwide.

While I try my hardest to make most of my training content available here, there simply isn’t a true replacement for in-person training or dedicated research and consulting.

Some of the things I offer:

• Training — Influence operations analysis, cybercrime and cyber threat intelligence analysis, OPSEC for investigators, domain analysis and more. Available in-person or remote.

• Research and investigations — Influence and cyber operations investigation, financial investigation services, and other bespoke OSINT investigations.

• Consulting — Capability assessment and development, methodology reviews, expert witness engagements, and advisory retainers.

If you’re curious about what I have to offer for you and your organization, just let schedule with me on Calendly or reach out at aribenam@memeticwarfare.io.

We’re taking a special and belated look at my latest long-form publication, focusing on a probably Qatar-linked operation. The report is available here.

The report is quite exhaustive, and there’s much more there so give it a read. I’ll go over some highlights, tips and tricks from the report below.

The operation we’re looking at is named “Eekad”. Eekad, a play on the Arabic root for truth. Eekad has been active since 2020 and positions itself, quite succesfully, as the “Arab region’s first open-source intelligence platform”. They’re on Twitter, YouTube, Facebook, Instagram and a semi-active domain.

What makes them interesting is that they pose as an investigative outfit, and use OSINT in a few key verticals:

• Covering influence operations

• Debunking viral content

• Geolocating content

• Social media and other analysis

The genius of this operation is that not only is the Arab world is apparently thirsty for this type of content, it provides a visage of legitimacy and accuracy. The average person can’t really tell whether or not satellite imagery is misrepresented, or if the way that Eekad presents impressive Gephi graphs as proof of an influence operation is in fact accurate.

Eekad has been caught promoting unsupported, misleading, inaccurate or overtly false claims on a number of topics - promoting and defending Qatar, denigrating Israel, Saudi Arabia, the UAE and even the Druze, and promoting the current Syrian government. All of these align with Qatari geopolitical interests.

To get a taste for their type of content - check out below some content claiming to expose networks:

On many cases they visualize different networks than the one above with Gephi to make a point that is otherwise unsupported:

Their emphasis on OSINT is apparent also in their YouTube channel. Open source investigation is their number one videotag. To do this type of analysis yourself, just check out Matt W’s YouTube Metadata bulk here.

Their Facebook page’s transparency section also includes references to Qatar, as well as Turkey (some employees are based there). Most of their ads were paid for in riyals and taken down due to violating Facebook’s political advertising rules. This is a general investigation tip as well - the FB ad library is amazing.

They have an inactive domain at eekad[.]com. However, if you enumerate its subdomains (available with all types of tools), you’ll find a subdomain at facts.eekad[.]com which was inactive for quite a while but at least exposes the original website.

Searching for the domain on Censys exposes one host with Eekad appearing in its HTTP response. This domain belongs to a PR firm, which is hosting a subdomain for Eekad on their own website which hosts an old version of the Eekad domain, showing that they’re tied. So Eekad has some money to throw around for PR firms, which most journalistic outfits of this size don’t.

We’ll conclude with two noteworthy events as well. The first is that Handala set up a domain to solicit information securely from visitors but didn’t bother encrypting the traffic by setting up an SSL cert, which is very funny:

The final thing I’ll point out is Singapore’s takedown of 6 domains seemingly targeting Singapore during its previous election period.

We get some detail below:

The domains are tied to known operations:

See the domains below:

Interesting to see how Singapore handles foreign influence and interference, managing to take down domains without raising the ire of those seemingly responsible.

That’s it for now, thanks for reading.

We’ll start off with a fantastic report from Domaintools Investigations on MOIS cyber and IO operations, with one of the better threat actor names - Moist Grasshopper.

Domaintools Investigations (DTI) consistently puts out some of the best reporting out there. If you’re a reader of Memetic Warfare, you should be a reader of their stuff.

I’d also like to shoutout Domaintools separately from this as well. When I first got started in investigations, I learned a ton from Domaintools’ blog, which would publish detailed investigations and guides. Much of it was an inspiration for what I try to do here.

Back to the report - see below:

The report is way too long for me to cover here and do it justice, but it hits every main point. It gets the structure of the MOIS and their threat actors, and more importantly lays out how they think and work very articulately. Check it out.

From here, we’ll cover more Iran.

I’m not one to usually link to content from the Intercept, but they do occasionally leave me no choice. One of their reporters exposed two covert CENTCOM news domains targeting Iran and Iraq, Pishtaz News and al-Fassel:

The two domains of course promote pro-US and anti-regime narratives, but like previous CENTCOM/contractor IO, they exhibit basic operational security mistakes, like having the sole account they follow be CENTCOM:

Or, even worse, not using a proxy or VPN:

Or, in perhaps the most egregious error yet, hosting a CENTCOM emblem on their domain for some reason:

Weirdly enough, these domains - like previously exposed CENTCOM domains in “Unheard Voices” provide some type of odd disclaimer on the domain itself, which they don’t have on their social media accounts. I honestly can’t think of why CENTCOM feels the need to do this? I can’t imagine the type of regulation requiring them to somehow disclose this.

This is described later in depth, with CENTCOM having changed its disclosures. Time to just drop it guys!

The article notes that the YouTube channel has some overtly AI-generated content:

Despite the effort, the domains’ accounts have essentially no traction:

Moving on, we’ll stay on Iran and take a look at the latest joint US government advisory on Iranian actors targeting critical infrastructure in the US, available here.

They don’t attribute it to Shahid Kaveh/cyb3rav3ngers or the IRGC but do mention how funnily enough that same group was doing the same thing back in the before times of 2023, and we also learn that they apparently hit 75 different devices, an interesting update showing the scale of the activity:

We also see that some of the activity hit government services, water and energy stations and so on, with some experiencing “operational disruption and financial loss”. We also probably had some defacement based on the first paragraph.

The IoC section is more interesting:

What’s interesting about the IP range is it occurs mainly via one AS, and specifically in one CIDR range even. It’s always useful to check sequential IPs, as shown here.

Most of the IP addresses are run by Ultahost, with the one beginning with 135 belonging to M247, a hosting service that we’ve seen exploited by Iran many, many times.

Ultahost has also has been exploited in the past for cyber and influence operations, ranging from Doppelganger to MOIS fronts such as Handala.

Just goes to show you the importance of monitoring problematic ASes.

That’s enough Iran for this week, thanks for reading.

As always, Memetic Warfare guest posts are the sole opinion of their author.

ISNAD that Deep: Persistent Islamist Influence Campaign Targeting Israel Adapts to Iran War

My name is Max Lesser. I work with Ari at the Foundation for Defense of Democracies (FDD). I am sharing research that I conducted in collaboration with my colleague Emmerson Overell and my interns Kellie McSween and Ethan Sheinker.

On March 10, Emma and I published a high-level overview of our findings on over 100 accounts on X that we linked to ISNAD, a persistent Islamist influence campaign that impersonates Israelis with the express intention of destabilizing Israeli society. An Egyptian expat with historical ties to the Muslim brotherhood orchestrates the operation, which crowdsources its participants. The expat, alongside a central management team, reportedly coordinates the participants via Telegram.

We identified 118 accounts that appear to impersonate Israelis, post coordinated paraphrased content, and amplify divisive narratives, including the following: the Israeli Prime Minister is evil; the Israeli government is an undemocratic regime; Israel’s leaders use war to distract the public and preserve power; and internal ‘enemies’—including Haredim, settlers, and the Israeli government—pose a bigger threat to Israel than Hamas or Iran. These tactics, techniques, and procedures (TTPs) and narratives align with reporting on historical ISNAD activity by researchers at Active Info, the HarediLine, the Institute for National Security Studies (INSS), and Fake Reporter, among others.

After the U.S.-Israel war with Iran began on February 28, the network began increasingly incorporating Iran-related narratives, which increased from 3% of the network’s total content before the war to over 20% of its content afterwards.

Impersonating Israelis

Between March 2nd and 9th, all 118 accounts in the network appeared to impersonate Israelis by posting Hebrew-language content speaking from the perspective of Israelis, and sometimes also by explicitly listing their location as Israel. 2 of these accounts, however, were no longer active as of March 30, 2026, i.e., @raphael95yair and @Poorbaby0.

X’s transparency features show that 57 of the accounts had metadata indicating a location outside Israel in either X’s ‘Account Based In’ or ‘Connected Via’ fields. X states that the country or region displayed under ‘About this Account’ is inferred from aggregated IP addresses. X’s ‘Connected Via’ field shows how an account’s user connected to X, which is often via an app store in a specific country or region. Regional app stores associated with this network spanned West Asia, North Africa, Europe, and East Asia, while country-based app stores included Egypt, Morocco, Germany, Iraq, Cyprus, Algeria, Tunisia, Italy, the UAE, and Côte d’Ivoire. Additionally, 68 accounts were marked as based in Israel in the ‘Account Based In’ transparency field. However, X flagged all 68 of these accounts for possible VPN use.

The location metadata described here is based upon observations made between March 2nd and 9th, and may not reflect the current location metadata. Location metadata can change over time when accounts connect in different regions or via different regional proxies, and this metadata can also be spoofed.

Figure: Images of four accounts in the network presenting themselves as Israelis

Figure : X’s transparency feature showing the same four accounts connecting via Android apps associated with Iraq, Morocco, and North Africa.

Coordinated Posting

The incongruity between many of the accounts’ Israeli presentation and their location metadata is a strong indicator of inauthenticity. The network’s posting behavior demonstrates that it is not only inauthentic, but also coordinated. Specifically, the network engages in coordinated posting activity where its accounts consistently post identical or nearly-identical (e.g., slightly paraphrased or rearranged) content.

This analysis collected posts from accounts suspected to be in the network between November 1, 2025 and March 9, 2026. It considered accounts to be part of this network if they engaged in at least one cluster of coordinated content. And so, definitionally, all 116 active accounts participate in at least one coordinated content cluster. In addition, 94 accounts in the network participated in at least 10 clusters; 46 accounts participated in at least 50 clusters; 16 accounts participated in more than 100 clusters; and 5 accounts participated in more than 200 clusters.

Figure: Network visualization of accounts that participated in at least 50 coordinated posting clusters. Node size is proportional to the number of distinct clusters each account participated in. Edge thickness is proportional to the amount of co-participation between two accounts, measured by how often they posted within the same coordinated clusters.

Within the collection period, the network posted 2,274 coordinated content clusters (i.e., content that is either identical or paraphrased and posted by at least two accounts in the network). 1,855 of these clusters were posted by the network 2–4 times; 354 clusters were posted 5–9 times; 50 clusters were posted 10–14 times; 13 clusters were posted 15–19 times; and 2 clusters were posted 20+ times. 1,974 clusters were posted by 2–4 accounts; 260 clusters by 5–9 accounts; 34 clusters by 10–14 accounts; 6 clusters by 15–16 accounts. These numbers demonstrate a high degree of coordinated posting activity across the network.

The largest coordinated content cluster includes Hebrew-language variants of a message stating that Israel is in an existential political crisis, that this crisis is as dangerous as Iran, that the Israeli government is more dangerous than Iran’s regime, and that immediate revolutionary action is necessary to overthrow it. This content was posted 22 times by 16 accounts in the network. Across these posts, the differences are limited to subtle changes in wording, register, and punctuation, while the overall structure and political message remain the same.

Figure: A sample of four posts from the largest coordinated content cluster. @WYylwn41269 and @shatz_david post identical messages while @DanielG_efen and @shera26116 each post slightly paraphrased variants.

A little under half of the network’s posts are replies. Moreover, of 17,589 replies in the dataset, 17,584 (99.97%) target accounts outside the 118-account network, likely to reach external audiences rather than create the impression of engagement with content posted by the network.

In addition to the network’s coordinated posting behavior, the timeline of the accounts’ creation dates are also compressed within a two year timeline. The earliest account in the network was created in May 2024. Over 90% of the accounts were created during or after January 2025, which is the month when Israel and Hamas reached their initial ceasefire agreement. The 2-year compressed timeline provides an additional indicator of coordination, albeit a weaker one than the posting patterns: from a random sample of over 100 authentic accounts, one would expect a broader temporal distribution than two years.

Key Narratives

Multiple key narratives persist throughout the network’s content. The most prevalent narrative demonizes the Israeli Prime Minister, Benjamin Netanyahu, characterizing him as the most pressing threat to Israel. The network’s posts often use words like “Traitor” (בוגד), “Swindler” (נוכל), and “Destroyer” (מחריב) when describing Netanyahu. Posts claim that Netanyahu is responsible for various wars, political decay in Israel, manipulating the public, and the collapse of Israeli institutions. Content posted by the network even includes the claim that Netanyahu has caused more damage to the Jewish people than anyone since Hitler, and that Netanyahu is more dangerous than Iran or Hamas.

Figure: A sample of four posts from a coordinated content cluster that attacks Benjamin Netanyahu.

Another key narrative is that the Israeli government has become a regime or theocracy, with Israel depicted as undergoing either democratic backsliding or collapse. Content communicating this narrative sometimes argues that elections are not a solution, and Israel instead needs revolution or uprising.

Figure: A sample of four posts from a coordinated content cluster depicting the Israeli government as undemocratic and dictatorial.

Another one of the network’s key narratives is that Netanyahu wages wars to preserve his power. Various claims include that the Israeli government is using war to distract the public, suspend elections, or create a permanent state of emergency.

Figure: A sample of four posts from a coordinated content cluster claiming that Netanyahu is waging war against Iran in an attempt to delay elections

Another key narrative frames internal Israeli actors—especially coalition politicians, right-wing ministers, settlers, and Haredi political blocs—as threats from within and, often, as the greatest threat to Israel. Posts frequently claim that these actors pose a greater danger to Israel than Hamas or Iran, with a particular focus on Haredi draft exemptions and the influence of right-wing ministers. Some posts go further, explicitly comparing Israeli politicians to Iran’s rulers, claiming that “there is no difference between the Ayatollahs in Iran and those here.”

Figure: A sample of four posts from a coordinated content cluster framing Haredim and settlers as a threat to Israeli society.

Another recurring narrative portrays the Israeli media as helping manufacture public consent for Netanyahu and for various wars, often using language such as “brainwashing” and “consciousness engineering.”

Figure: A sample of four posts from a coordinated content cluster claiming that the Israeli media is manipulating Israeli public consciousness.

Between the start of Operation Epic Fury (February 28) and the end of the collection period (March 9), the network increasingly leveraged the U.S.-Israeli strikes against Iran in its divisive narratives. These included claims that Netanyahu was using the conflict to preserve power, that people and politicians within Israel posed a greater threat than Iran, and that Israeli coverage of the Iran war was manipulative and propagandistic. As mentioned earlier, Iran-related narratives increased from 3% of all its content before February 28 to over 20% of its content afterwards.

Figure: A sample of four posts from a coordinated content cluster claiming that Iran does not want to eliminate Israelis, but Trump and Netanyahu do.

Attribution

The network appears to be a wing of the persistent Islamist influence campaign known as ISNAD. ISNAD’s TTPs and narratives closely align with those seen in the network discussed in this analysis. Previous TTPs associated with ISNAD include the following: impersonating Israelis on X and other platforms; posting coordinated messages that are slightly paraphrased to avoid detection; and primarily posting replies to authentic Israeli accounts. ISNAD’s narratives exploit divisive political and social topics within Israel, often heavily criticizing the Israeli government. More specific narratives associated with ISNAD include attacking Netanyahu, accusing the Israeli government of failing to protect its citizens, criticizing Haredim and settlers, and occasional calls for uprisings or revolution.

ISNAD’s participants come from regions across the globe including West Asia, North Africa, and Europe, which aligns with the location data of most accounts in the network discussed in this analysis. Additionally, many of the accounts appear to attempt to mask their location with a VPN, which is also a TTP associated with ISNAD.

Given that many of the accounts have metadata on X showing their location is in “Western Asia,” it is possible that there is some Iranian participation in this network. Iranians also have impersonated Israelis in the past. However, nothing specifically indicates Iranian involvement, as this metadata could also be associated with one of over a dozen other West Asian countries. The most plausible attribution of this network is to ISNAD, rather than Iran.

The network’s activity demonstrates how ISNAD’s crowdsourced, “grassroots” influence operations can achieve persistence and rapidly adapt to emerging events to destabilize Israeli society.

Richard Hancock is a threat intelligence researcher at DarkOwl specializing in darknet intelligence, OSINT, and counterterrorism. His work examines how extremist and hybrid threat actors leverage distributed digital ecosystems to shape narratives, manufacture perceived power, and influence real-world outcomes.

As per Richard, rather than emerging as a clearly defined militant organization, Harakat Ashab al-Yamin appears to function as a distributed identity embedded within a broader ecosystem of Iranian-aligned channels. This piece examines how claims, media, and narratives move across platforms, revealing a model where influence is constructed through amplification, reuse, and strategic signaling rather than centralized control.

As always, guest posts on Memetic Warfare are the opinion of their author alone.

Let’s begin.

Harakat Ashab al-Yamin al-Islamia: A New Group or Part of a Broader Iranian-Aligned Network?

A previously unknown group calling itself Harakat Ashab al-Yamin al-Islamia (Ashab al-Yamin) has emerged, claiming responsibility for a series of attacks across Europe and quickly attracting attention from analysts and media outlets. Recent reporting by Long War Journal has documented the group’s increasing tempo of claimed attacks across Europe, noting at least 15 incidents since March. Reporting by CBS News, citing researchers from Tech Against Terrorism and others, has similarly highlighted the group’s sudden appearance and raised questions about whether it represents a genuine operational network or a rapidly assembled media construct linked to broader geopolitical dynamics.

The group’s activity appears largely confined to Telegram, where it publishes a mix of attack claims, propaganda, and geopolitical commentary. Its presence is fragmented, with limited persistent content and much of its activity preserved through secondary or supporter accounts.

Rather than evaluating Ashab al-Yamin as a standalone entity, a closer examination of its Telegram activity suggests a different framing. Patterns of shared content, cross-channel distribution, and overlapping narratives indicate that the group operates within a broader, loosely connected ecosystem of Iranian-aligned channels. This ecosystem overlaps with networks commonly associated with the “Islamic Resistance,” where claims, media, and messaging circulate across multiple accounts rather than originating from a single source.

This raises a central question: is Ashab al-Yamin a distinct organization, or a visible node within a broader networked ecosystem of influence and amplification?

Telegram Activity and Content Patterns

As of early April 2026, the group’s primary Telegram channel, Harakat Ashab al-Yamin al-Islamia, appears to have been removed or banned from the platform. The most recent identifiable content, dated April 4, included a video claiming responsibility for an attack targeting a building associated with Christians for Israel in Nijkerk, Netherlands. While a potential successor channel may exist, no clearly verified or consistently active replacement has been identified at the time of writing, reinforcing the group’s fragmented and unstable presence across Telegram, where continuity appears dependent on redistribution rather than sustained ownership of a single channel.

Since that time, additional content attributed to Ashab al-Yamin has continued to surface across secondary channels, particularly through Sabereen News. Multiple new videos published between April 15 and April 19 claim attacks across European cities, including Munich, London, and North Macedonia. These releases follow a consistent format and narrative framing, reinforcing the pattern of distributed dissemination observed throughout this analysis.

One such example includes a video depicting a purported attack targeting Israeli diplomatic infrastructure in London, featuring hazmat-style protective gear and a small drone bearing Ashab al-Yamin insignia. The use of printed insignia and staged visual elements appears intended to signal authorship and operational credibility, regardless of independently verifiable evidence.

[Screenshot 1& 2: Frames from Ashab al-Yamin video depicting a purported London-based attack, featuring a small drone and hazmat-style protective gear marked with printed insignia, illustrating visual signaling of authorship]

Open-source image hosting platforms have also been observed containing files associated with Ashab al-Yamin insignia, reinforcing the possibility that elements of the group’s visual identity are assembled and distributed through accessible online tools rather than a centralized media apparatus.

[Screenshot 3: Propaganda-style graphic associated with Ashab al-Yamin, combining group insignia with a stylized European cityscape, reinforcing the role of visual media in signaling authorship and amplifying perceived operational reach]

As a result, much of the group’s observable activity is derived from secondary or supporter channels, such as صفي الدين (Safee al-Deen), which continues to circulate attack claims, propaganda, and related content attributed to the group.

Initial review of these channels suggests they do not function solely as claim-of-responsibility outlets. Instead, they operate as hybrid media nodes, combining attack claims, geopolitical commentary, and propagandistic amplification of broader regional narratives.

For example, content includes battlefield or intelligence-style analysis, such as satellite imagery purportedly showing damage to U.S.-linked air facilities in Bahrain and Kuwait following Iranian strikes. The accompanying text describes specific targets such as hangars, fuel storage, and drone infrastructure.

[Screenshot 4: Satellite imagery / strike analysis post]

This style of posting is consistent with content observed across pro-Iranian Telegram channels, where content blends battlefield updates, geopolitical commentary, and narrative amplification alongside claims of responsibility for attacks in Europe.

[Screenshot 5: London ambulance attack claim video]

Another example includes a video documenting an arson attack in London targeting ambulances associated with a Jewish community organization. The accompanying Arabic-language caption frames the incident as an operation carried out by Ashab al-Yamin, referencing a synagogue in the British capital and linking the action to broader anti-Israel narratives.

More recent content attributed to the group includes claims related to an attack targeting a commercial center in Amsterdam. One such post states:

[Screenshot 6: Amsterdam attack video from Ashab al-Yamin]

حركة أصحاب اليمين الإسلامية تتبنى استهداف المركز التجاري العالمي في أمستردام، وتدعو شعوب أوروبا إلى الابتعاد عن المصالح الأمريكية والصهيونية فوراً

Translation:
“The Islamic Movement of Companions of the Right claims responsibility for targeting the World Trade Center in Amsterdam and calls on the peoples of Europe to immediately distance themselves from American and Zionist interests.”

The limited availability of such claims on the group’s official channel, combined with their continued circulation across secondary and affiliated channels, complicates efforts to identify a single point of origin. Instead, messaging is distributed across multiple accounts, where content persists through redistribution rather than consistent publication from a single source.

Content Origination and Cross-Channel Linkages

One particularly notable detail is the presence of Sabereen News branding within video content that was previously reposted by Ashab al-Yamin’s official Telegram channel.

[Screenshot 7: Ashab al-Yamin post showing Sabereen News watermark; London attack]

Sabereen News is a Telegram-based media outlet widely associated with Iranian-aligned networks, with multiple analyses pointing to links with Iran’s Islamic Revolutionary Guard Corps–Qods Force (IRGC-QF) and Iran-backed militia groups. Research by the Washington Institute for Near East Policy notes “strong indicators” of IRGC-QF connections and highlights that the channel first appeared on Telegram in January 2020. More recent reporting from Iran International similarly reflects its position within IRGC-linked messaging networks.

The visible Sabereen News watermark within the footage of the London ambulance attack suggests that the video was either sourced from, or circulated through, an Iranian-aligned media channel prior to being reposted by Ashab al-Yamin. Rather than serving as definitive proof of origin, this overlap indicates participation in a shared media pipeline where content is reused and redistributed across channels.

This interpretation is further supported by activity observed on the Sabereen News channel, which regularly publishes operational updates, threat messaging, and geopolitical narratives aligned with Iranian interests.

[Screenshot 8: Sabereen News missile / strike-related footage]

Additional Sabereen content illustrates this broader narrative environment.

[Screenshots 9 & 10: Sabereen News corporate targeting / company list]

In this example, Sabereen News publishes a list of Western companies, including technology firms, financial institutions, and defense-related entities, framing them as potential targets linked to broader geopolitical events. While this is not a direct claim of responsibility, it reflects a broader pattern of signaling and narrative shaping seen across affiliated channels.

Additional recent content from Sabereen News further illustrates its role as a central distribution node within this ecosystem. In some cases, this aggregation extends beyond Iranian-aligned actors.

For example, Sabereen News has been observed resharing content attributed to Sunni jihadist groups, including material linked to Ajnad Bayt al-Maqdis. The original post appears to have been published by a Telegram account operating under the name “hamid alqawsi,” before being redistributed through Sabereen. The group’s recent pledge of allegiance to al-Qaeda, dated February 2026, coincides with broader regional escalation, reinforcing patterns of opportunistic emergence tied to major geopolitical events. This further illustrates how content moves across distinct networks through centralized amplification channels.

[Screenshots 11 & 12: Original Telegram post from “hamid alqawsi” account and subsequent repost by Sabereen News]

In a separate example, the channel reposts video footage attributed to Hezbollah depicting a missile strike on the Israeli town of Kiryat Shmona. While not directly linked to Ashab al-Yamin, this type of cross-group content aggregation highlights how Sabereen functions as a broader amplification hub, circulating material from multiple actors and reinforcing shared narratives across the network. Channels such as Sabereen News therefore remain key points of observation for tracking how new identities emerge and reappear within this network.

[Screenshot 13: Sabereen News Telegram post reposting Hezbollah-attributed missile strike footage targeting Israel]

An earlier Telegram channel, Haraka Ashab Al Yamin, identified as one of the first to publish content associated with the Amsterdam attack, appears to have been removed or banned from the platform, further complicating efforts to trace content back to a single point of origin.

Across posts, several additional patterns emerge that reinforce this ambiguity. The language is primarily Arabic, with no observable use of Farsi despite speculation of Iranian association, and messaging consistently incorporates anti-Israel and anti-Western themes aligned with broader regional narratives. Taken together, these characteristics further complicate attribution and raise questions about the group’s structure, consistency, and underlying coordination, which become more apparent when examining its claims and media output more closely.

Indicators of Authenticity vs Narrative Construction

The available Telegram content presents a mixed picture of Ashab al-Yamin’s credibility as an operational group. While the channel attempts to project visibility through attack claims and messaging, it lacks several features typically associated with more established militant organizations.

Unlike known Iranian-aligned and PMF-affiliated groups, Ashab al-Yamin does not consistently produce formalized statements, leadership messaging, or a clearly defined media structure. Its presence appears limited in scale, with no clear evidence of sustained or centralized coordination.

At the same time, the quality and style of its media output vary noticeably, with some videos appearing more refined and others more rudimentary. This inconsistency likely reflects contributions from multiple actors rather than a single coordinated media wing.

This aligns with assessments from analysts cited in CBS News, who note that such output may be designed to generate psychological impact rather than demonstrate operational sophistication.

The group’s messaging also closely tracks ongoing geopolitical developments, suggesting a degree of responsiveness and an understanding of how to maximize visibility within a rapidly evolving information environment.

Taken together, these patterns support the interpretation put forward by the Foundation for Defense of Democracies: that Ashab al-Yamin may function less as a centralized organization and more as a front identity used to claim attacks carried out by loosely connected or externally recruited individuals. This ambiguity becomes more meaningful when placed alongside the wider ecosystem in which the group operates.

More broadly, this model reflects a pattern observed across comparable ecosystems, where decentralization, narrative amplification, and perceived reach are often prioritized over formal organizational structure. In such contexts, visibility and attribution can be strategically leveraged to amplify perceived impact without requiring sustained operational capability.

PMF and Iranian-Aligned Telegram Ecosystem

Rather than viewing Ashab al-Yamin in isolation, its activity is better understood within a broader cluster of Telegram channels linked to the “Islamic Resistance” ecosystem. This ecosystem aligns with what is often described as the “Axis of Resistance,” a network of Iranian-aligned state and non-state actors operating across the Middle East and beyond.

This ecosystem includes a mix of militia-linked channels, media outlets, and amplifier accounts. Channels such as:

• شباب الإسلام

• أصحاب الكهف

• جيش الغضب

• صفي الدين

• التعبئة الشعبية للمقاومة الإسلامية في العراق ( بسيج العراق)

• القدرات العسكرية الإيرانية

These channels regularly publish claims, updates, and propaganda tied to attacks against U.S. and allied targets, while also forwarding and resharing content from one another. These channels function as an interconnected network, regularly cross-posting and reinforcing shared narratives.

[Screenshot 14: Safee al-Deen / ecosystem connections post]

Posts such as the above highlight explicit relationships between multiple groups operating under the umbrella of the “Islamic Resistance,” including Ashab al-Kahf and Jaysh al-Ghadab.

Ashab al-Kahf is an Iraqi militia group aligned with the Islamic Resistance in Iraq, known for claiming attacks against U.S. military and allied targets in the region. Its Telegram presence reflects a structured communication style, including consistent branding, formalized statements, and clearly framed claims of responsibility

[Screenshot 15: Ashab al-Kahf Telegram profile / branding insignia]

Jaysh al-Ghadab similarly operates within this ecosystem, publishing claims and messaging tied to attacks and broader resistance narratives. Like Ashab al-Kahf, its content reflects a more established and consistent media presence, with recognizable visual identity and integration into a wider network of affiliated channels.

[Screenshot 16: Jaysh al-Ghadab Telegram profile / branding insignia]

While these groups exhibit more structured branding and communication styles, they operate within the same broader environment as Ashab al-Yamin. Screenshots 17 and 18 illustrate formalized statements published by Ashab al-Kahf and Jaysh al-Ghadab, both of which were subsequently forwarded by the Shabab al-Islam channel. This pattern highlights how official statements originating from more established actors are redistributed across affiliated channels, reinforcing shared narratives, and expanding reach.

[Screenshot 17 & 18: PMF formal statement example]

Both statements follow a consistent format typical of PMF-aligned media output, including religious framing, attribution of attacks against U.S. and Israeli interests, and references to specific operations. For example, one statement claims responsibility for a drone attack targeting Israeli-affiliated infrastructure in Jordan, while emphasizing civilian evacuation warnings and framing the operation within a broader resistance narrative. The second statement similarly adopts formalized language, invoking religious justification, and positioning the attack within the context of ongoing regional conflict. This contrast becomes more apparent when comparing how similar attack-related content appears across different channels within the network.

[Screenshot 19: London ambulance attack claim Ashab al-Yamin TG channel]

[Screenshot 20: London ambulance attack claim: Safee al-Deen TG channel]

Screenshots 19 and 20 show the same London ambulance attack being circulated through Ashab al-Yamin and Safee al-Deen channels, illustrating how identical content is redistributed across different nodes within the network, often with variations in framing and presentation.

These examples illustrate how similar content is circulated, reframed, and redistributed across different channels, reinforcing visibility and narrative consistency.

A Networked Playbook

The emergence of Ashab al-Yamin aligns with a broader pattern seen across similar ecosystems: the rapid creation of new identities designed to claim responsibility, amplify narratives, and generate strategic effects.

Recent analysis by Militant Wire similarly suggests that the group may function less as a traditional organization and more as an “astroturfed” identity embedded within existing Iranian-aligned networks, leveraging low-cost, high-visibility activity to maximize perceived impact.

Rather than representing the development of a traditional, hierarchical organization, this model prioritizes speed, flexibility, and visibility. New entities can quickly establish a presence, insert themselves into ongoing events, and reinforce narratives already circulating across interconnected channels.

As noted in reporting by CBS News, even relatively unsophisticated or ambiguous content can achieve outsized strategic effects. This aligns with analysis from the Foundation for Defense of Democracies, which notes that such models can rely on low-cost, deniable actors and coordinated messaging without requiring a formal organizational structure.

Recent research by the Global Network on Extremism and Technology similarly highlights how digital actors across different ideological and operational backgrounds can converge within shared wartime ecosystems, forming loose networks that amplify common narratives and targets.

These dynamics are not limited to militant media channels. Similar patterns can be observed among pro-Iranian hacktivist groups, which use Telegram to promote alleged data breaches and advertise them on darknet marketplaces. For example, “APT Iran” has claimed to possess stolen data from Lockheed Martin, promoting it through Telegram and advertising it on a Russian-language darknet marketplace known as “Threat Market.”

The listing advertises an estimated value of approximately $374 million, with an exclusive buyout price nearing $600 million, alongside tiered pricing for partial data access. While these figures remain unverified, their scale reflects a broader pattern of inflated valuation and narrative amplification, where the perceived significance of a breach is emphasized as much as the underlying data itself.

[Screenshot 21 & 22: APT Iran Telegram post referencing Lockheed; Lockheed leak posted on Threat Market]

More recent activity suggests increasing instability and responsiveness to external pressure. Following attention surrounding the alleged Lockheed Martin leak, the actor associated with “APT Iran” appears to have changed its Telegram identity to “Brona Blanco” and begun posting images of purported source code tied to the breach. Concurrent messaging in Farsi references potential law enforcement scrutiny, including warnings about FBI targeting of infrastructure linked to Threat Market and the implementation of contingency measures such as a “dead man’s switch.”

[Screenshot 23: APT Iran Telegram post referencing the FBI targeting Threat Market]

[Screenshot 24: APT Iran/Brona Blanco Telegram post referencing Lockheed Martin Source Code]

While these claims remain unverified, this shift in tone and behavior reinforces a consistent pattern observed across these actors: rapid escalation in claims, reactive messaging driven by perceived pressure, and an emphasis on perceived impact over independently verifiable outcomes.

This same dynamic is evident in recent claims by a group calling itself “Ababil of Minab,” which has claimed responsibility for a cyber incident targeting Los Angeles Metro infrastructure. As reported by Dark Web Informer, the group used Telegram to publicize the claim, asserting large-scale data exfiltration and system disruption while providing limited verifiable evidence. While attribution remains unclear, the group’s messaging style and distribution patterns reflect characteristics observed across other Iranian-aligned or Iran-affiliated cyber personas.

[Screenshot 25: “Ababil of Minab” Telegram posts claiming responsibility for a cyber intrusion targeting LA Metro]

As with other actors in this ecosystem, the framing of the operation emphasizes scale and impact, including claims of hundreds of terabytes of data being wiped and additional sensitive data extracted. This reflects a recurring dynamic in which perceived significance is amplified through messaging rather than confirmed technical outcomes.

This interpretation is consistent with emerging reporting on Iran-linked hybrid activity, where analysts have noted coordinated behavior across pro-Iranian digital ecosystems and raised questions about the authenticity of some groups operating within them.

Conclusion

Harakat Ashab al-Yamin al-Islamia has emerged rapidly, but its fragmented Telegram presence, recycled media, and overlap with Iranian-aligned channels complicate its assessment as a standalone organization.

Instead, it is best understood as part of a broader ecosystem in which content is circulated, repurposed, and reinforced across multiple actors. In this environment, attribution becomes less about identifying a single origin point and more about understanding how narratives move and gain traction across interconnected channels.

This model allows new entities to project visibility and claim relevance without demonstrating sustained operational capability, blurring the line between coordinated activity and opportunistic amplification.

As this environment evolves, tracking how new entities emerge, gain visibility, and integrate into existing ecosystems will remain critical to understanding how influence is constructed and projected.

It all began a bit over a week ago when LA’s metro authority confirmed that it was popped.

The intrusion only led to some noncritical systems being taken down, and service wasn’t disrupted meaningfully. An Iranian group took credit for the operation, and Dataminr was the first to report it.

The name itself is a reference to the Quran, with the ababil itself meaning a “flock”. This isn’t just any flock, but a specific one referred to in the Quran as having protected Mecca from an invading army. The reference to Minab is to the school bombed by the US in the Israel/US-Iran war, which has turned into a trope of Iranian propaganda.

Most of the overtly Islamic references I’ve seen in fronts have been related to ASA, but there have been others, as well as other bird-brained Iranian/Hizballah related operations.

You can see the logo and aesthetics clearly here:

They’ve had two main targets so far. The most recent is Vyncs, a GPS company, which they hit with a defacement on April 11th:

They include screenshots of the company’s SQL database and other internal systems:

Their first operation, as stated, was against Metro.net, LA county’s transit authority:

They managed to get in to their VMWare environment:

From there, they manually deleted clusters and uploaded some footage from street cameras:

They also gained access to some OT infrastructure, in this case managing a rail yard:

They even engage in real memery, which is something you don’t often see from the front groups themselves, and is more the type of thing I’d expect from Mr. Soul/cyberav3ngers and less from ASA or even the MOIS.

Jokes aside, their opsec isn’t perfect. They expose a TLS certificate for the host that points to the domain, which Validin picks up below, exposing the true host, despite it being behind Cloudflare.

We also see two identical domains registered on different TLDs on Cloudflare - just like the IRGC espionage operation from last week.

Despite being hosted on Cloudflare, the domain was registered on Ultahost - a registrar and hosting provider we’ve seen used by Iran multiple times in the past weeks:

The host just exposes a default Apache (one of the most common web server) homepages.

Trying to connect to the host on port 443 for HTTP (to see if the domain is hosted on the site still) gets a refusal as I lack a client certificate.

This means that they’ve locked down the ability to connect to the site hosted on the server directly, which is better operational security than we’re used to seeing, even though they messed up with the host TLS certificate.

This is especially odd considering that some of their links lead to open directories?

The domain is otherwise uninteresting, no favicon results, interesting SOA or DNS records or otherwise.

We also have some interesting post op activity. They operators seem to be running a burner, impersonating a customer responding to a tweet from Vyncs and referring to the domain:

This screams ASA to me, as it’s the type of thing they do and less for say cyberav3ngers/APT IRAN.

As stated earlier, they started off with a Telegram channel and Twitter account. The Telegram channel is already shadowbanned, and the Twitter account has been taken down.

Like past ASA operations, they do have backups ready to go on Twitter:

We also have an Arabic-language Twitter account which is still active. This is the type of thing that ASA does, they often run fronts in Arabic which we see less of from other groups:

This one is a fun one attribution-wise.

• Actual intrusion into critical infrastructure. Leans more towards IRGC (Cyberav3ngers or ASA), though could be MOIS

• Prepositioned backups ready to go on Twitter, something ASA has done, though other MOIS orgs have also (Handala in particular)

• Use of Cloudflare - past IRGC operations, higher value

• Islamic-language and aesthetics, similar to ASA

• Running the operation partially in Arabic, points to ASA

• Targeting US critical infrastructure, but seemingly for real (at least to some degree) similar to IRGC actors like APT Iran/CyberAv3ngers, ASA

• Running additional entities beyond the main accounts - most commonly seen with ASA and IRGC actors but also done occasionally by MOIS actors

• Registering two domains on Cloudflare simultaneously like last week’s IRGC spying operation. This means this is a higher-investment operation and I can’t recall many cases when the MOIS used Cloudflare, but I could be wrong.

• Tighter OpSec than most MOIS operations

I’m inclined to believe that this is IRGC-related and not MOIS due to the above points.

The question there is, ASA or Cyberav3ngers/APT-Iran?

This one is a bit less clear, but if I absolutely had to guess, I’d lean towards ASA due to the specific TTPs - creating a new, higher-investment front with Islamic branding, but it could just as easily be cyberav3ngers or any other IRGC-related group (memery, timeline etc) or even the MOIS.

That’s it for this week, thanks for reading.

To summarize, the individual, who said they edited the Israeli military newspaper “BaMachane” in 2016, received a message from an SMS sender named “IRGC”. The message says, in stilted Hebrew:

“In the name of the conquer of Khaybar, Niv, the commander of “BaMachane” in “Dotz” [shortened name of Israeli Military Spokesperson’s office]. We know that you [plural] taste the taste of death every day. This isn’t the future built for you. You must stand against the brutal and stupid acts of Netanyahu. The moment of the collapse of your corrupt government is very close. This is your last opportunity to live in peace with other honest people in the world. To save your lives, send a message [url]”.

This caught my eye for a few reasons.

Firstly, most Iranian SMSes sent like this don’t include a link or personal information, whereas this message refers to the target by name and includes information on his past unit, indicating that the sender has at least that personal data on the individual.

Secondly, the information available is accurate, as confirmed by the guy who tweeted it.

Iranian operators could have this from multiple sources, including scraping social media for past unit affiliation, breached data for name and phone numbers or other, bigger data breaches (say, LinkedIn). Regardless, highly targeted SMSes.

So, let’s take a look at the link. The short URL resolves to the below domain:

In short, the site is a “center for the recruitment and absorption [possible reference to similar phrasing in the Israeli “Bakum”, the base where all soldiers officially join the military] of personnel from various intelligence, defense, security, military and government organizations and institutions in Israel”.

Most notably, the site is overtly run by the IRGC. This is interesting as this is, to the best of my memory, the first IRGC-branded domain. Others have been organization-agnostic or tied to MOIS-related actors.

The site offers “special support services to people who send us secret and classified information from Israel”, including:

• Payment of “secure and untrackable” salary via crypto

• Payment via various foreign currencies

• Payment of a high salary immediately for those who carry out “special operations”

• Payment of a high salary those in active service and retirees as “an additional job”

• Provision of asylum or shelter to those recruited

The site also states that all communication is handled in a “completely secure” fashion, “far from any cyber or field surveillance”, and that the “interaction” for them is their top priority in terms of safety and anonymity.

The site then invites those that have “initiative”, or special “personality or group” skills to contact them via Telegram or via the site directly. Funnily enough, they ask also for a resume via Telegram, and run a Telegram bot to make communication easier.

They were kind enough to include a FAQ:

They’re apparently gunning for leaders of “organized groups”:

Marxists would be happy to see that the IRGC doesn’t buy into the concept of unskilled labor, saying that “in our opinion no one lacks expertise, everyone has skills”:

Let’s take a look at their entities. The Telegram channel was created on March 21st but only became active on April 2nd:

It already has 11,500+ subscribers, many of which I assume are fake to give it an air of legitimacy.

The posts themselves are obviously very much AI-generated and posted in English and Hebrew:

The domain infra isn’t super interesting.

They’re using the Russian DDoSGuard service, as Handala and other Iranian groups have many times in the past.

They have one past host on M247, which Iranian IRGC and MOIS actors have used many times in the past, but not much of interest is available there now. It’s now off of the M247 host, which only had HTTP/S ports open anyway, and fully on DDoSGuard.

Doing a quick search for similarly named domains finds one .com domain which previously was on CloudFlare, but was taken down presumably quickly.

Back to the domain itself. In contrast to past recruitment operations, which went as wide as possible in terms of targeting and had a strong IO component to them, this operation is focused and stealthy, comparatively at least.

This campaign clearly targets exclusively military/government personnel, which makes sense based on the person who first flagged it and the probable sourcing they’re using, not people off of the street.

We can also see this focus reflected in the source code for the domain. The robots.txt file is set as “noindex, nofollow” to prevent all indexing by search engines. They don’t want it to be found or exposed too early, but rather just seen by those sent links.

They’ve tightened up the exposed WordPress endpoints that are so often left exposed:

They’ve even obfuscated the admin login panel, though not in a way that would impact anyone really interested in popping the site from finding it:

By diving into the source code we can find the line where they call WordPress APIs and the obfuscated URL to find it:

They’re using the forms tool SureForms to receive incoming messages with a webhook integration:

Overall, a very interesting development here. To summarize, we have an IRGC espionage recruitment operation specifically targeting military/government personnel, and presumably using breached data and/or other open source data to target people individually.

In contrast to MOIS or other recruitment operations, this operation tries to keep a low profile and has minimal to no IO components to it. The operation is also less exposed than other MOIS operations, which casually throw OpSec to the wind.

Quite interesting IMO and definitely a space to keep watching.

That’s it for this week, thanks for reading.

What caught my eye was an article from the Wall Street Journal covering claims that Iran has wiped at least 60 companies. I hadn’t heard much about a new large-scale wiper campaign, so I decided to take a look.

After checking the usual suspects, I noticed that Anonymous for Justice, known for having popped an email server of the Israeli MOJ in one of Iran’s more successful intrusion ops, was responsible for the lion’s share of these intrusions.

As a side note, I’ve always wanted to publish more on Anonymous for Justice but there’s an Israeli gag order on it, so I’ve held off. Perhaps one day I’ll be able to get something out on them.

I was ready to be impressed with perhaps some new malware or tooling, or some impressive targets. Instead, they’ve been hitting quite literally whatever they can, including Israel’s most reputable and well-known food powder companies:

The best part though is seeing them delete the data. In the few dozen videos they’ve uploaded, you can see videos at 2-3x speed of them manually deleting files. They were in such a hurry to do this that they couldn’t automate it or use previous wiper toolkits, which is interesting in of itself.

I hate to discuss Handala ad nauseum as well, but they’ve also been engaging in similar shenanigans. They also recently targeted St Joseph county in the US in a similar fashion to past breaches, which is getting them up there with past IRGC intrusions into US infrastructure.

They seem to have nothing of actual value, despite having taken the “most sensitive and classified information” of the good people of St. Joseph’s county, sharing photos of misdemeanor complaints, medical test results, and some lines in a database. The final sentence got me, claiming that the information “has the potential to permanently alter the administrative and social order and security of this region”.

Not to rehash endlessly everything that they do, but Handala has been targeting and deleting data from a number of Israeli companies. Similarly to Anonymous for Justice, they’re also manually deleting files:

As mentioned on MW in the past, they’re also very interested in continuing to recruit Israelis and show no signs of stopping. I’ve seen them use TOX in the past but this may be one of the first times they’ve used Session:

The last thing we’ll discuss is APT Iran’s claim to have exftiltrated 308108 petabytes of data from Lockheed Martin. In reality they only claimed to have stolen a few hundred terabytes, which is equally as unlikely.

I’ve seen some coverage of people saying this is financially motivated, and I am begging you: it is absolutely not. Charging some exorbitant price is all about making it a more appealing news item.

Those of you interested in APT Iran, a fascinating front tied to the IRGC and cyb3rav3ngers, see below:

The interesting part here is the creation of ThreatMarket. ThreatMarket is a Russian language channel and Onion site:

They post in English as well, and claim that APT Iran asked them to sell the data from Lockheed Martin:

They offer the data for sale at a very reasonable 600 million USD ish:

This is absolutely ANOTHER case of Iran impersonating Russian actors for their hacktivist fronts. The MOIS did a very similar thing back in the day with Hunt3r Kill3rs in the IDF Leaks operation:

In fact, it isn’t even the first time that they’ve offered data for sale as part of their IO efforts - see below:

Speaking of Cyber Isnaad Front, some of their previously hacked material is also making headlines now, with some of their old hacked material being now used by Iranian IO efforts apparently (or perhaps grassroots Iranian activity) to allege that an Israeli woman was somehow involved with the US operation in Iran. Funny how these things work out.

That’ll be it for this week, thanks for reading.

We have a few things to look at this week.

Firstly, we’ll start off with Domaintools Threat Intelligence’s latest look at the accidental exposure of a TLS certificate private key in Qihoo 360’s latest security automation product. Very interesting to get a look at how China’s premier information security company operates.

In addition to always being highly detailed and high quality, DTI also often puts out useful visuals and explains in-depth what’s going on. As someone whose learning journey has relied very much on blogs and technical writeups, I’m always appreciative of companies that take the time to do this:

From there, we’ll check out the FBI’s latest advisory on Iran, specifically the use of Telegram as C2 infra from the MOIS for cyber-enabled IO.

On a separate note, we’re really living in the golden age of MOIS activity, the IRGC used to be the only player in town worth mentioning, not so much anymore.

We get some detail here. Nothing super advanced - relies on social engineering to get the malware onto the device by making it appear to be Telegram or some other app (after having presumably messaged the target a malicious link to download it), and then interestingly connected to Telegram bots to exfiltrate the data. We see this confirmed in the “initial access” section:

Based on past Iranian operations, it seems that they could only effectively export data from installed apps such as Telegram or perhaps WhatsApp, as most of what I recall we saw came from there, but I could be wrong. This is in fact confirmed in the file names of the malware, showing Telegram, WhatsApp and even KeePass being impersonated:

There’s a specific reference to Handala:

And a broader explanation of how Iranian actors just love doing cyber-enabled IO:

We’ll conclude with what I assume is an AI-generated visual describing the flow:

From here, we’ll take a look at a great look from Max Bernhard on a phishing campaign hosted by Aeza targeting European officials over Signal and other applications:

I’ll put the summary below:

Defisher is a commercial tool, and it may be used by other actors beyond whoever was using it before. This is also a stellar example showingthe value of fingerprinting and searches on Censys.

It starts with the Defisher login panel, which may seem mundane. However, like anything unique (ish, in this case), we can find a way to write a unique query for it on Censys to find HTTP responses that match the page content.

The simplest way is to just look up Defisher as it’s the unique component of the panel on Censys, but if this panel were more unique, we could try to write an even more specific query to find exact pages that this panel appear on.

We can easily check that out by trying to fingerprint the panel, in this case just looking up “defisher” in Censys, giving us a domain running HTTP, in this case even having the title be “Defisher”:

We can easily check this bad boy out and see that it’s another instance of the same panel:

The host server it’s on hosts this site and one other which glaringly imitates WhatsApp authentication:

Now, there’s more that one could do with this, but the point here is that by just doing this quick pivoting we found additional instances of defisher being run.

It appears that they’re part of the same campaign,based exclusively on the similarity here of the WhatsApp auth domain and the aforementioned article, but we would have to find other points to line up first before confirming.

That’s it for this week, thanks for reading.

I’m opening this week’s post with a sad development: the time of death of Meta’s now semiannual threat report, available here.

See the executive summary below and you’ll begin to see why. Firstly, there’s a huge focus on things that are important, sure, like fraud and scams and so on, but these come at the expense of cyber and influence operations, which get short shrift. One could argue that fraud and scams and nudify apps and so on are on the whole worse for society, and that may be true, but it’s still disappointing to see what was once the core of the threat report be relegated to a few pages at the end.

I’m also going to take a moment here to digress. I’ve often been pro-Meta in the industry as they were one of the few companies to actually publish, as well as provide account and page transparency as well as an accessible ad library.

One thing they haven’t been good at is sharing credit or cooperating with the community. I’ve shared impactful things with Meta multiple times, only to never hear anything back or see any action take place. I’ve seen Meta report on things covered on my blog or others months before only to see no reference to them. If you aren’t Open AI, Microsoft or one or two other companies, then you aren’t really an industry peer or part of the “research community” as far as Meta goes.

Now that that’s over, let’s move on to what we do have: an Iranian influence operation with some success across Facebook and Instagram. This operation targeted the US with a smaller component targeting Iraq.

We get some information on the background use of infrastructure, for example “clean devices” and “proxy IP usage” - not that that’s so technically-sophisticated per se, though perhaps I’m just biased here and think that’s par for the course. Despite the use of proxy infra, Meta still found “signals” that tied it together, so they clearly weren’t so professional about it.

The information on the identities is interesting - we get political American figures, sure, but also an Albanian satirist, despite Albania not being mentioned in the rest of the report. I assume that the Albanian persona was meant to swing public opinion in Albania (a known thing that Iran focuses on due to the MeK being based there), so odd that Meta didn’t further expand on that.

We see the actual accounts below:

And another, pretty clearly using a GAN image background:

And a last one named “Millar Levy”, a very odd name that I truly can’t pin on any one ethnic group, and certainly not a Jew as Levy would imply.

The final interesting note is that once caught, the network “pivoted to a strategy focused on speed and volume”, throwing content quality and abandon to the wind.

We also get some interesting insight into Pakistani domestic activity using AI. The use of AI meme cracks me up, as if it’s at all difficult to use AI nowadays.

Can only imagine which “industry peer” tipped them off to this, and no, I am not hinting that it was me.

We also get some content samples, which is nice because we don’t always get those from Meta:

The AI used is as follows: essentially, at every stage, which makes sense.

We of course have the requisite Russian operations also, showing some success:

The reliance on proxy IP providers is something that, while it’s great that it’s stated by Meta, should be taken for granted at this point.

We also have a Chinese operation with nothing particularly interesting about it.

We also have one final Iranian operation targeting Azerbaijan. This one is interesting in that Meta found that it was run by two Azeris based in both Iran an Germany, as well as the long-running span of the operation and the “high-quality persona building” there.

So, that’s it I guess. The Meta threat report went quarterly, now semiannual, and each time includes significantly less information. That’s life I guess.

Thanks for reading.

We’ll take a look this week at the DOJ’s seizure of four domains related to MOIS operations such as Handala and Homeland Justice, available here.

Let’s take a look at the affidavit. We’ll skip the boring introduction. Getting past the background, at section 8 we see a reference to a “hack targeting REDACTED” in March 2026. Wow, wonder who it could be! I’m fine with most redactions, but if it’s an international headline, you probably don’t need to redact the name.

The redaction here gets to be kind of ludicrous. For example, footnotes 3, 4 and 5 are redacted (for some reason unclear to me, but whatever). The weirdest part is that the example referred to that identified the three as being run by the same actors is redacted, but clearly shows who posted it in the footnote. What is the point here?

Have to give the FBI credit here for coming up with a new term no one has ever used, “faketivist”:

We get a bit of insight into the Handala operation targeting what I presume is Iran International, showing that they were probably phished via Telegram:

For those curious, if you google “runtimessh.exe”, you’ll find results from AnyRun (similar to VirusTotal):

The first one is kind of boring, but the second hit for a past submission shows that the executable appeared in a zip file called “Telegram Authenticator”:

We can then jump to the very cool analysis feature on AnyRun and see them run the file, showing us that it is indeed a Telegram phishing app, masquerading as the “Telegram Technical TEAM” and having people input their activation code:

Shows just how simple a lot of this work can be, even when done to journalists who are constantly targeted.

The next interesting point is the use of crypto to purchase the domain.

I don’t particularly care which exchange it is, but it’s a great usecase for ChatGPT as it provides its own thesis. Interestingly we do see here how they were able to trace it back to an Iranian exchange.

We also get a look at how the FBI runs its own virtual HUMINT operations:

The absolute funniest part of this IMO appears in the message chain:

Just look at how the FBI agent writes. Full sentences, no contractions, absolutely glows in the dark IMO.

S/he did in fact successfully purchase the data, not hard considering that the goal of this operation is to amplify the hack and leak and get the data out to as many people as possible:

The “Heavygram-Keepass” Malware section seems super interesting but is mostly redacted:

We get a bit in the next page, showing a US victim and again use of the RunTime file as well as an executable called winappx. AnyRun also has this and it too is a stealer, using Telegram to exfiltrate data:

We also get some insight into how the Stryker hack impacted medical services:

We even get an intimidation email sent by Handala referring to their “partners”, the Mexican Cartel Jalisco Nueve Generacion (CJNG) to indimiate Americans.

We’ll conclude with a final look at a new Iranian recruitment operation, in this case running ads on Israeli news websites:

The post here, titled “Top Secret” and “encrypted”, says that the Islamic Republic of Iran is looking for an “intelligence partner” in Israel, offering 3,500 USD in crypto, which it claims “cannot be discovered”, and also offering “life and location of your choice”, presumably after clicking the ad.

Interesting that they can somehow consistently run these ads on Israeli sites via whichever ad partners they exploit, and it’s an interesting development to see them go right to a news site and not say just on Twitter as in the past.

That’s it for this week, thanks for reading.

I haven’t had the personal time to dedicate to a truly killer post like you’re all used to by now due to the ongoing regional war, and for that, you have my sincerest apologies. We should be back to normal soon hopefully.

I rarely do this, but this week I have no choice. Instead of a short, somewhat timely, often practical and most importantly, edgy, blog post, you’ll get a curated reading list of multiple things that I personally have on my to-read list in their entirety which I am now dubbing the Memetic Warfare Reading Corner.

The first is a report from Georgetown’s CSET from a month or two ago on Chinese military use of AI and their “wishlist”, available here.

While interesting, this isn’t the type of thing we’d normally discuss at Memetic Warfare, but there are a few cool things about it.

The first is that it relies heavily on RFP (request for proposal) documents - thousands of them - publicly available in China. These are the few types of public documents one can actually work with in China (alongside some customs documents) as well as patents, tenders and so on. Other corporate data is often unavailable via most methods, if at all, to obscure ownership.

There also is a short “cognitive warfare” section, focusing on requests for t hings like “deepfake” systems, which I find to be a bit overplayed. The request for a library is an interesting one:

Detection also came up:

They also had requests for broader, “LLM-powered” intelligence platforms for cognitive targeting:

Lastly, we get some information on social engineering:

Overall, a super interesting paper with a lot of utility, one of the better usecases for OSINT available.

The next Memetic Warfare Reading Corner recommendation is an academic article from Antonia-Laura Pup on the Romanian elections, foreign interference and the role of intelligence agencies:

Check out the abstract here. This one is more for those interested in policy and governance and so on, but still interesting IMO to see academic treatment of IO and intelligence in a specific event, especially one so recent.

The next piece we’ll look at is Graphika’s latest look at Iranian hacktivist fronts, a topic near and dear to my heart, available here. This is a follow up to their previous report on the topic, link available in the report. Key findings below:

There’s a lot of great stuff so give it a read if you’re interested in the space, but we’ll skip right to the Cyber Isnaad Front section:

If you were wondering, the “industry peer” is an article quoting the FDD and Memetic Warfare on this, though we disagree on attribution - I’d use higher confidence.

One of the great things about the report is the focus we get on lesser-discussed groups, such as Gaza Children Hackers:

We’ll conclude with one report from a great team to follow, Domaintools Threat Intelligence, available here on RRN/Doppelganger.

I’ll share the summary and breakdown below, focusing of course heavily on domain registration:

It’s very cool to see Domaintools really dive in to what they’re best at: domains.

Check it out, it’s fascinating and super high quality. Great stuff.

That’s it for this week, thanks for reading.

What a week, huh?

Let’s get started with some non-Iran related content, as it’s pretty early on and I’ll have more to say I’m sure going forward.

We’ll start off with Open AI’s latest threat report, available here.

We’ll skip the romance scams section and get right to the Silver Lining Playbook section:

Those of you who read MW regularly may be able to guess what I’m referring to here. I, of course, am referring to the fact that Memetic Warfare is the number one place to read about cool online operations before they get referred to in threat reports. Case in point here.

This operation, originating in China (probably, but let’s be real), focuses on actors using ChatGPT to look up people, forums and federal buildings, generate emails, look into face-swapping software and so on - all to serve a front company named “Nimbus Hub Consulting”.

Those of you with a sharp memory may recall this post:

In this guest post by Max Lesser, Nimbus Hub (alongside dozens of other domains) are exposed to be Chinese espionage domains. Give it a read.

Back to Open AI’s section. They add relevant information from LinkedIn activity (useful as well because they have access to telemetry by virtue of all being under Microsoft)

We also get insight into what they were querying - mainly using ChatGPT to write emails for recruitment, but also carrying out reconaissance on federal employees, their locations, job seekers and more. The face-swapping part is also interesting and presumably to be used in any face to face interaction.

That becomes clearer as we see the type of emails they’d write:

While great from Open AI, this is only a very small part of the puzzle, and it would’ve been nice of them to include a reference to MW or the FDD piece on it for further context as well as credit.

We’ll skip the other influence operations which are pretty par for the course, if still interesting geographically,and go to the most unique section - China’s “Cyber Special Operations”.

Because the Chinese simply do not care about exposure or OpSec, a Chinese official affiliated with a law enforcement body (probably the MPS) used ChatGPT to plan an influence operation targeting Japan:

We see that the user used ChatGPT to generate periodic reports on “cyber special operations” against global targets, showing that apparently Chinese operators use Chinese open-source models and have hundreds of operators (no surprise there). We also see that it’s probably tied to Spamouflage, so further strengthening ties to the MPS:

The operators use Qwen and Deepseek apparently, and began planning an operation against Japan’s Iron Lady following her statements re inner Mongolia, the best-named Chinese province. We also get insight into the operation itself, which focused not just on mean tweets but also setting up inauthentic email addresses to email Japanese politicians, “coopting local internet users” and running counter-operations online:

We also get exposure of used hashtags:

I especially like the use of anime to run IO:

We get even more information re TTPs towards the end, showing how the operator is probably tied to the MPS Working Group 912.

Really interesting information showing domestic and foreign activity:

We get great insight into how China actually runs these operations: hundreds of operators, active on over 300 social media platforms, using AI for monitoring, translation, content generation and more.

That’s it for this week, thanks for reading.