TAG-182 Threat Cluster Spreads MarkiRAT Malware

Insikt Group researchers attribute a targeted cyber-surveillance campaign to TAG-182 (suspected Iran-aligned) that lures Farsi-speaking users with fake VPNs and media players to distribute the MarkiRAT remote-access/spyware; the report details the infection chain, stealth/persistence techniques (BITS job manipulation, dropping svehost.exe), attacker infrastructure (malicious domains, Let’s Encrypt certs, shared hosting), and active promotion on social media aimed at dissidents during regional internet outages.