Loading threat actor…
TAG-182 is an Iran-linked cyber-surveillance threat cluster associated with malware delivery and monitoring activity directed at Farsi-speaking users in and outside Iran. The activity is assessed as aligned with Iran’s broader domestic monitoring and repression ecosystem, which includes institutions such as the Islamic Revolutionary Guard Corps, the Basij Cyber Council, FATA, and the Ministry of Intelligence and Security. Its operations fit a pattern of identifying opposition, suspected dissidents, and alleged foreign collaborators during periods of heightened internal security pressure. TAG-182 has been observed distributing the MarkiRAT remote access trojan through lures themed as VPN software, media players, and utilities. The malware supports covert collection and exfiltration, including screenshot capture and transmission of victim data to attacker-controlled infrastructure. Observed tradecraft includes masquerading, use of deceptive software installers and archives, abuse of native Windows administration utilities for payload retrieval, and persistence through a process name designed to resemble a legitimate Windows component. This indicates a focus on defense evasion, post-compromise surveillance, and sustained access to victim systems. The cluster’s targeting has centered on Farsi-speaking individuals, including users inside Iran as well as members of the broader Iranian-speaking community abroad. The operational context and lure themes strongly indicate a surveillance mission rather than financially motivated cybercrime or ransomware. TAG-182 is best characterized as an Iran-nexus monitoring actor supporting internal security and intelligence collection objectives through malware-enabled access, victim surveillance, and data exfiltration.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
54 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Surveillance of dissidents and diaspora using lures tied to informal software channels to distribute malware to Farsi-speaking users.
Iran-nexus threat activity cluster using the MarkiRAT backdoor in malware-laced VPN/player-themed installers and archives to support surveillance and detection of anti-government opposition.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.