Lightnews — Scholar-powered news

Nariman Gharib @nariman.bsky.social · 1h

BellaCiao was developed at Tehran's Shuhada base. Moses Staff & Sahyoun24 weren't independent—all run by the same IRGC unit. MORE... blog.narimangharib.com/posts/2025%2... #APT35

Part two and three of the leaked Charming Kitten files reveal operations across five continents

In my previous analysis of the Charming Kitten leak, I examined the unprecedented breach that exposed the inner workings of an Iranian state-sponsored hacking o...

blog.narimangharib.com

Nariman Gharib @nariman.bsky.social · 14d

t.me/narimangharib

Nariman Gharib @nariman.bsky.social · 15d

Breaking News: Iranian Advanced Persistent Threat Group #APT35 Has Been Compromised, with Internal Documents Leaked Online

blog.narimangharib.com/posts/2025%2...

Massive Leak Exposes Inner Workings of Iranian Hacking Group Charming Kitten

In what appears to be one of the most significant breaches of an Iranian state-sponsored hacking operation to date, an anonymous source has published internal d...

blog.narimangharib.com

1 1 2

Reposted by Nariman Gharib

Joe Tidy BBC News @joetidy.bsky.social · 27d

BREAKING: Two teenagers charged over 'Scattered Spider' Transport for London cyber attack. About to appear in court for first time. I'm here for BBC so follow the story for updates: www.bbc.co.uk/news/article...

Teenagers charged over Transport for London cyber attack

Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested

www.bbc.co.uk

1 5 10

Nariman Gharib @nariman.bsky.social · Sep 13

www.international.gc.ca/transparency...

Iran-linked hacker group doxes journalists and amplifies leaked information through AI chatbots

Rapid Response Mechanism Canada (RRM Canada) has detected a “hack and leak” operation by Iran-linked hacker group, “Handala Hack Team” (Handala). The operation targeted five Iran International journal...

www.international.gc.ca

Nariman Gharib @nariman.bsky.social · Sep 10

It's truly enjoyable to see the efforts of the Islamic Republic's cyber forces as they try to use social engineering on me.

Reposted by Nariman Gharib

SentinelOne @sentinelone.com · Sep 4

Your cyber threat intel is part of the North Korean strategy: DPRK operators are abusing CTI platforms to see if they’ve been seen—and moving faster because of it. 👀

1 7 6

Reposted by Nariman Gharib

Raphael Satter @raphae.li · Sep 4

Granular look here from @ajvicens.bsky.social and I on how job seekers in the crypto currency industry are being bombarded with fake job offers from North Korean hackers. Based on 19 interviews with targets and research from cyber firms @sentinelone.com and Validin

www.reuters.com/world/asia-p...

Exclusive: How North Korean hackers are using fake job offers to steal cryptocurrency

North Korean hackers are saturating the cryptocurrency industry with credible-sounding job offers as part of their campaign to steal digital cash, according to new research, raw data, and interviews.

www.reuters.com

4 7

Nariman Gharib @nariman.bsky.social · Sep 3

There might be some kind of history in my ancestors that I’m not aware of. 😆

Nariman Gharib @nariman.bsky.social · Sep 3

🤣🤣🤣🤣🤣🤣

1

Reposted by Nariman Gharib

Cloudflare @cloudflare.social · Sep 2

A recent security issue announced by Salesloft has impacted many companies, including Cloudflare. Read more

https://blog.cloudflare.com/response-to-salesloft-drift-incident/?utm_campaign=cf_blog&utm_content=20250902&utm_medium=organic_social&utm_source=bluesky

The impact of the Salesloft Drift breach on Cloudflare and our customers

An advanced threat actor, GRUB1, exploited the integration between Salesloft’s Drift chat agent and Salesforce to gain unauthorized access to Salesforce tenants of Cloudflare and many other companies.

blog.cloudflare.com

2 5 12

Reposted by Nariman Gharib

Catalin Cimpanu @campuscodi.risky.biz · Sep 2

A UK government study has found that, despite being aware that cyber insurance exists and is an option, most British companies struggle to understand insurance policy details, which is impeding a broader adoption

www.gov.uk/government/p...

2 3 9

Nariman Gharib @nariman.bsky.social · Aug 29

Screw it, unlocking the paywall on my Charming Kitten investigation. Everyone should know how they're impersonating former Pentagon officials to target activists. Full technical details, IoCs, everything that was VIP-only is free now
vip.narimangharib.com/charming-kit...
#APT35

Charming Kitten 2025: Strategic Target Selection and Researcher Surveillance Analysis

Overview This research examines a new Charming Kitten campaign utilizing advanced impersonation tactics, long-term monitoring of security researchers, and unique infrastructure. This analysis is base...

vip.narimangharib.com

4 5

Nariman Gharib @nariman.bsky.social · Aug 28

The Islamic Republic is floating the idea of unblocking Telegram again

blog.narimangharib.com/posts/2025%2...

The Telegram Trap: Why Iran's

The Islamic Republic is floating the idea of unblocking Telegram again, and if you believe this is about digital freedom, I have a bridge in Tehran to sell you....

blog.narimangharib.com

Nariman Gharib @nariman.bsky.social · Aug 23

In recent hours, intelligence agencies in the Islamic Republic, including the Shahid Kaveh group, have attempted to deny any cyberattacks on their ships by LabD cyber group. And as always, they said I am a member of unit 8200 of the Israeli army. 😆😆

Nariman Gharib @nariman.bsky.social · Aug 22

LabDookhtegan paralyzed 64 Iranian ships at sea last night, again...

blog.narimangharib.com/posts/2025%2... #Iran #CyberAttack

Inside the Lab-Dookhtegan Hack: How Iranian Ships Lost Their Voice at Sea

Lab-Dookhtegan has been systematically targeting Iranian infrastructure for months now, and when they reached out about their latest operation, I knew it would ...

blog.narimangharib.com

1

Reposted by Nariman Gharib

Bellingcat @bellingcat.com · Aug 14

In May, we, alongside CBC's Visual Investigation Unit, @tjekdet.dk and @politiken.dk revealed the identity of the key administrator behind one of the largest AI porn sites. Dutch politicians across political parties are now calling for the Canadian to be extradited. www.cbc.ca/news/canada/...

5 79 180

Nariman Gharib @nariman.bsky.social · Aug 14

Iran's defense sector offers $213,000 prize for counter-drone technology, seeking systems to detect and neutralize small UAVs through jamming, AI tracking, or physical interception. Competition highlights Tehran's push for indigenous anti-drone capabilities hxxps://archive[.]is/qCyIt

1

Nariman Gharib @nariman.bsky.social · Aug 13

You can watch the video here with English subtitles: blog.narimangharib.com/posts/2025%2...

Handala Hacker Exposed: Iran International Identifies Intelligence Ministry Operative Behind Cyber Attack

Tonight, Iran International TV revealed the identity of one of the key figures behind the Handala hacking group that claimed responsibility for attacking the ne...

blog.narimangharib.com

1 1

Nariman Gharib @nariman.bsky.social · Aug 13

Tonight, Iran International TV exposed the identity of a Handala hacking group admin—part of the Banished Kitten cyber unit I've previously reported on—and unmasked his handler in Iran's Ministry of Intelligence.

- Morteza Aftabi-Far
- Ali Bermoudeh