Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool

Executive Summary: Recorded Future’s Insikt Group identifies TAG-182 as an Iran-nexus surveillance cluster distributing MarkiRAT via fake VPN and media-player lures targeting Farsi-speaking users; the report details malware behavior (BITS jobs, persistence, beaconing), associated infrastructure (domains, IPs, ASNs), IoCs (SHA256 hashes, domains, IP addresses), and detection artefacts (YARA and SIGMA rules), and assesses likely ties to other pro-Iranian surveillance groups.