Nariman Gharib
@nariman.bsky.social
Britain-based Iranian Activist 🚦 Cyber Espionage Investigator 👁
New from the Charming Kitten #APT35 leak: Payroll records exposing 35 IRGC cyber operatives with names, bank accounts, and salaries. Additional footage of the Kashef surveillance platform tracking Iranian citizens. And a classified 2004 document... blog.narimangharib.com/posts/2025%2...
Charming Kitten Leak Continues: Payroll Data and a Stolen IAEA Document
In my previous analyses of the Charming Kitten leak, I examined the organizational structure, target lists, financial infrastructure, and operational capabiliti...
blog.narimangharib.com
December 9, 2025 at 7:21 PM
New from the Charming Kitten #APT35 leak: Payroll records exposing 35 IRGC cyber operatives with names, bank accounts, and salaries. Additional footage of the Kashef surveillance platform tracking Iranian citizens. And a classified 2004 document... blog.narimangharib.com/posts/2025%2...
wait for it.
a computer screen with a netflix logo on the bottom
ALT: a computer screen with a netflix logo on the bottom
media.tenor.com
December 9, 2025 at 2:45 PM
wait for it.
The Ministry of Intelligence of the Islamic Republic's cyber group "Banished Kitten", which is operating under the name "Handala", has gained access to Suvarnabhumi Airport (BKK). blog.narimangharib.com/posts/2025%2...
Exclusive: Handala's Thailand Blunder - MOIS Accidentally Exposes Access to Bangkok Airport
The cyber group "Banished Kitten," operating under the alias "Handala" and affiliated with the Ministry of Intelligence and Security of Iran (MOIS), has once ag...
blog.narimangharib.com
December 3, 2025 at 2:30 PM
The Ministry of Intelligence of the Islamic Republic's cyber group "Banished Kitten", which is operating under the name "Handala", has gained access to Suvarnabhumi Airport (BKK). blog.narimangharib.com/posts/2025%2...
Reposted by Nariman Gharib
NEW: Europol shut down Cryptomixer, a crypto service alleged to have facilitated the laundering of 1.3 billion euros since 2016.
Service was allegedly used by cybercriminals, drug and weapons traffickers, and ransomware gangs.
techcrunch.com/2025/12/01/e...
Service was allegedly used by cybercriminals, drug and weapons traffickers, and ransomware gangs.
techcrunch.com/2025/12/01/e...
European cops shut down crypto mixing website that helped launder 1.3 billion euros | TechCrunch
Europol announced the seizure of Cryptomixer’s official website, as well as 25 million euros and 12 terabytes of data from the mixer's service.
techcrunch.com
December 1, 2025 at 6:42 PM
NEW: Europol shut down Cryptomixer, a crypto service alleged to have facilitated the laundering of 1.3 billion euros since 2016.
Service was allegedly used by cybercriminals, drug and weapons traffickers, and ransomware gangs.
techcrunch.com/2025/12/01/e...
Service was allegedly used by cybercriminals, drug and weapons traffickers, and ransomware gangs.
techcrunch.com/2025/12/01/e...
Today I am presenting the call logs from #APT35's IRGC-IO official VoIP services. This exclusive information was previously detailed in episode 4 of the KittenBusters series.
- files.narimangharib.com/other/FanapT...
- files.narimangharib.com/other/Custom...
- files.narimangharib.com/other/FanapT...
- files.narimangharib.com/other/Custom...
November 26, 2025 at 3:29 PM
Today I am presenting the call logs from #APT35's IRGC-IO official VoIP services. This exclusive information was previously detailed in episode 4 of the KittenBusters series.
- files.narimangharib.com/other/FanapT...
- files.narimangharib.com/other/Custom...
- files.narimangharib.com/other/FanapT...
- files.narimangharib.com/other/Custom...
new blog post on #APT35 blog.narimangharib.com/posts/2025%2...
Department 40 Exposed: Inside the IRGC Unit Connecting Cyber Ops to Assassinations
A massive leak of internal documents has blown the cover off one of Iran's most active hacking groups. For years, the cybersecurity community tracked them as AP...
blog.narimangharib.com
November 24, 2025 at 5:00 PM
new blog post on #APT35 blog.narimangharib.com/posts/2025%2...
Exposing the identity of "Unit 40" managers of IRGC intelligence;
Tehran's largest espionage intelligence database #APT35 #CharmingKitten
content.iranintl.com/unit40/index...
Tehran's largest espionage intelligence database #APT35 #CharmingKitten
content.iranintl.com/unit40/index...
افشای هویت مدیران «اداره ۴۰» اطلاعات سپاه؛بزرگترین بانک اطلاعاتی جاسوسی تهران
content.iranintl.com
November 20, 2025 at 2:13 PM
Exposing the identity of "Unit 40" managers of IRGC intelligence;
Tehran's largest espionage intelligence database #APT35 #CharmingKitten
content.iranintl.com/unit40/index...
Tehran's largest espionage intelligence database #APT35 #CharmingKitten
content.iranintl.com/unit40/index...
Are you ready? Wait for new updates from the kittens. 😆
November 17, 2025 at 9:47 AM
Are you ready? Wait for new updates from the kittens. 😆
New Charming Kitten APT35 leak shows their entire budget. Bitcoin payments for domains and hosting, ProtonMail accounts (still active, I checked), Iranian shell companies, the whole operation running on maybe $10k.
Episode 4: Inside Charming Kitten's Financial Operations and Infrastructure Network
The fourth release of leaked documents from Iran's APT35 (Charming Kitten) operation exposes something previous leaks haven't: the complete financial backbone a...
blog.narimangharib.com
October 28, 2025 at 12:45 AM
New Charming Kitten APT35 leak shows their entire budget. Bitcoin payments for domains and hosting, ProtonMail accounts (still active, I checked), Iranian shell companies, the whole operation running on maybe $10k.
Group-IB Threat Intelligence uncovered a sophisticated phishing campaign orchestrated by the Advanced Persistent Threat (APT) MuddyWater, targeting international organizations worldwide to gather foreign intelligence. www.group-ib.com/blog/muddywa... #RavinAcademy
www.group-ib.com
October 22, 2025 at 9:08 AM
Group-IB Threat Intelligence uncovered a sophisticated phishing campaign orchestrated by the Advanced Persistent Threat (APT) MuddyWater, targeting international organizations worldwide to gather foreign intelligence. www.group-ib.com/blog/muddywa... #RavinAcademy
A comprehensive database containing complete registration records of Ravin Academy students has been obtained by me, revealing detailed personal information of individuals enrolled in the organization's training programs.
blog.narimangharib.com/posts/2025%2...
blog.narimangharib.com/posts/2025%2...
Exclusive: Full Student Database of MOIS-Affiliated Ravin Academy Leaked
Based on the intelligence assessments from multiple government agencies, Ravin Academy functions as a MOIS-directed recruitment and training front operating und...
blog.narimangharib.com
October 22, 2025 at 7:43 AM
A comprehensive database containing complete registration records of Ravin Academy students has been obtained by me, revealing detailed personal information of individuals enrolled in the organization's training programs.
blog.narimangharib.com/posts/2025%2...
blog.narimangharib.com/posts/2025%2...
BellaCiao was developed at Tehran's Shuhada base. Moses Staff & Sahyoun24 weren't independent—all run by the same IRGC unit. MORE... blog.narimangharib.com/posts/2025%2... #APT35
Part two and three of the leaked Charming Kitten files reveal operations across five continents
In my previous analysis of the Charming Kitten leak, I examined the unprecedented breach that exposed the inner workings of an Iranian state-sponsored hacking o...
blog.narimangharib.com
October 16, 2025 at 9:44 AM
BellaCiao was developed at Tehran's Shuhada base. Moses Staff & Sahyoun24 weren't independent—all run by the same IRGC unit. MORE... blog.narimangharib.com/posts/2025%2... #APT35
Breaking News: Iranian Advanced Persistent Threat Group #APT35 Has Been Compromised, with Internal Documents Leaked Online
blog.narimangharib.com/posts/2025%2...
blog.narimangharib.com/posts/2025%2...
Massive Leak Exposes Inner Workings of Iranian Hacking Group Charming Kitten
In what appears to be one of the most significant breaches of an Iranian state-sponsored hacking operation to date, an anonymous source has published internal d...
blog.narimangharib.com
September 30, 2025 at 9:14 PM
Breaking News: Iranian Advanced Persistent Threat Group #APT35 Has Been Compromised, with Internal Documents Leaked Online
blog.narimangharib.com/posts/2025%2...
blog.narimangharib.com/posts/2025%2...
Reposted by Nariman Gharib
BREAKING: Two teenagers charged over 'Scattered Spider' Transport for London cyber attack. About to appear in court for first time. I'm here for BBC so follow the story for updates: www.bbc.co.uk/news/article...
Teenagers charged over Transport for London cyber attack
Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested
www.bbc.co.uk
September 18, 2025 at 1:29 PM
BREAKING: Two teenagers charged over 'Scattered Spider' Transport for London cyber attack. About to appear in court for first time. I'm here for BBC so follow the story for updates: www.bbc.co.uk/news/article...
It's truly enjoyable to see the efforts of the Islamic Republic's cyber forces as they try to use social engineering on me.
September 10, 2025 at 11:48 AM
It's truly enjoyable to see the efforts of the Islamic Republic's cyber forces as they try to use social engineering on me.
Reposted by Nariman Gharib
Your cyber threat intel is part of the North Korean strategy: DPRK operators are abusing CTI platforms to see if they’ve been seen—and moving faster because of it. 👀
September 4, 2025 at 1:58 PM
Your cyber threat intel is part of the North Korean strategy: DPRK operators are abusing CTI platforms to see if they’ve been seen—and moving faster because of it. 👀
Reposted by Nariman Gharib
Granular look here from @ajvicens.bsky.social and I on how job seekers in the crypto currency industry are being bombarded with fake job offers from North Korean hackers. Based on 19 interviews with targets and research from cyber firms @sentinelone.com and Validin
www.reuters.com/world/asia-p...
www.reuters.com/world/asia-p...
Exclusive: How North Korean hackers are using fake job offers to steal cryptocurrency
North Korean hackers are saturating the cryptocurrency industry with credible-sounding job offers as part of their campaign to steal digital cash, according to new research, raw data, and interviews.
www.reuters.com
September 4, 2025 at 4:02 PM
Granular look here from @ajvicens.bsky.social and I on how job seekers in the crypto currency industry are being bombarded with fake job offers from North Korean hackers. Based on 19 interviews with targets and research from cyber firms @sentinelone.com and Validin
www.reuters.com/world/asia-p...
www.reuters.com/world/asia-p...
Reposted by Nariman Gharib
A recent security issue announced by Salesloft has impacted many companies, including Cloudflare. Read more
https://blog.cloudflare.com/response-to-salesloft-drift-incident/?utm_campaign=cf_blog&utm_content=20250902&utm_medium=organic_social&utm_source=bluesky
https://blog.cloudflare.com/response-to-salesloft-drift-incident/?utm_campaign=cf_blog&utm_content=20250902&utm_medium=organic_social&utm_source=bluesky
The impact of the Salesloft Drift breach on Cloudflare and our customers
An advanced threat actor, GRUB1, exploited the integration between Salesloft’s Drift chat agent and Salesforce to gain unauthorized access to Salesforce tenants of Cloudflare and many other companies.
blog.cloudflare.com
September 2, 2025 at 5:14 PM
A recent security issue announced by Salesloft has impacted many companies, including Cloudflare. Read more
https://blog.cloudflare.com/response-to-salesloft-drift-incident/?utm_campaign=cf_blog&utm_content=20250902&utm_medium=organic_social&utm_source=bluesky
https://blog.cloudflare.com/response-to-salesloft-drift-incident/?utm_campaign=cf_blog&utm_content=20250902&utm_medium=organic_social&utm_source=bluesky
Reposted by Nariman Gharib
A UK government study has found that, despite being aware that cyber insurance exists and is an option, most British companies struggle to understand insurance policy details, which is impeding a broader adoption
www.gov.uk/government/p...
www.gov.uk/government/p...
September 2, 2025 at 7:38 PM
A UK government study has found that, despite being aware that cyber insurance exists and is an option, most British companies struggle to understand insurance policy details, which is impeding a broader adoption
www.gov.uk/government/p...
www.gov.uk/government/p...