Iran-Linked TAG-182 Uses MarkiRAT to Spy on Farsi-Speaking Targets
Summary
Recorded Future links TAG-182 to MarkiRAT malware distributed through fake VPN and media apps, likely targeting Iranians at home and abroad. The report details infrastructure, malware behavior, possible overlap with Ferocious Kitten, and detection rules.
Key points
- TAG-182 distributes MarkiRAT through fake Android apps and VPN or media-player lures, including Pis2ray VPN and YEPlayer.
- The report assesses that the operation likely targets Farsi-speaking Iranians inside Iran and abroad, including people associated with anti-government movements.
- A staged YEPlayer archive leads to malware execution and beaconing to attacker-controlled infrastructure.
- MarkiRAT uses BITS for file-transfer activity; analysis also describes a disguised executable named svehost.exe and commands that expose and terminate it.
- Infrastructure and BITS tradecraft overlap with historical Ferocious Kitten MarkiRAT samples, but the report says more evidence is needed to establish an organizational link.
- The report includes domains, IP addresses, file hashes, ATT&CK techniques, and YARA and Sigma rules for defenders.
Article Details
- Attack Vectors
- TAG-182 distributes MarkiRAT through fake Android applications masquerading as VPNs and media tools, including Pis2ray VPN and YESHICA YEPlayer.
- Targets are directed from fake application lures to staged archives, including YEPlayer.rar, which delivers the payload.
- The malware sends beaconing and upload traffic to attacker-controlled domains, including a multipart/form-data POST to /up/uploadx.php.
- MarkiRAT uses BITS jobs through bitsadmin to retrieve files from remote URLs.
- Social media lures, including Instagram posts promoting fake applications, target Farsi-speaking users.
- Defensive Notes
- The article provides a YARA rule for detecting MarkiRAT and a SIGMA rule for identifying bitsadmin downloads associated with MarkiRAT URLs.
- Monitor for bitsadmin commands using /addfile alongside URLs containing /i.php?u= or /uploadx.php?u=.
- Monitor for MarkiRAT-related processes and artifacts, including svehost.exe under C:\Users\Public\AppData\Windows, and the described attrib -h and taskkill behavior.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | accountes[.]google[.]comesignt[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | admin[.]google[.]com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | admin[.]instagram[.]com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | c[.]pis2ray[.]online | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | come-signin[.]quest | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | comesignt[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | comestore[.]site | Listed as TAG-182 infrastructure and listed as a malicious domain indicator. |
| DOMAIN | comisignin[.]online | Listed as TAG-182 infrastructure and as a malicious domain indicator. |
| DOMAIN | comx-view[.]store | Listed as TAG-182 infrastructure and as a malicious domain indicator. |
| DOMAIN | download[.]yeplayer[.]store | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | google[.]com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | google[.]com-signin[.]site | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | google[.]comisignin[.]online | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | host[.]comview[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | microsoft[.]come-site[.]website | Used in a MarkiRAT BITS job URL; listed as a TAG-182 malicious domain indicator. |
| DOMAIN | microsoft[.]comesite[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | microsoft[.]comi-site[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | microsoft[.]comview[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | microsoft[.]pis2ray[.]online | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | microsotf[.]comi-site[.]website | Known malicious domain used for MarkiRAT beaconing and upload traffic. |
| DOMAIN | miga[.]comesignt[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | migavpn[.]store | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | min[.]come-site[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | min[.]comi-site[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | min[.]comview[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | min[.]pis2ray[.]online | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | ns1[.]com-signin[.]site | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | ns2[.]com-signin[.]site | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | orbitx[.]site | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | pis2ray[.]online | Domain used for fake VPN application lures and listed as a TAG-182 malicious indicator. |
| DOMAIN | prx[.]pis2ray[.]online | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | sahar2ray[.]online | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | starvpn[.]pis2ray[.]online | TAG-182 infrastructure advertising a fake Star Link application. |
| DOMAIN | svpn[.]pis2ray[.]online | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | tools[.]sahar2ray[.]online | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | vip[.]yeplayer[.]store | Attacker-controlled staging host serving the YEPlayer.rar payload. |
| DOMAIN | vpn[.]pis2ray[.]online | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | webmail[.]com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | webmail[.]facebook[.]com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | webmail[.]google[.]com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | webmail[.]instagram[.]com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | www[.]facebook[.]com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | www[.]google[.]com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | www[.]instagram[.]com-accounts[.]website | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | www[.]pis2ray[.]online | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | www[.]yemplayer[.]site | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | www[.]yeplayer[.]store | Listed as a TAG-182 malicious domain indicator. |
| DOMAIN | yemplayer[.]site | Listed as TAG-182 infrastructure and as a malicious domain indicator. |
| DOMAIN | yeplayer[.]store | TAG-182 infrastructure used for the YEPlayer lure and listed as a malicious domain indicator. |
| IPV4 | 212[.]83[.]61[.]198 | Listed in the malware-sample table as a TAG-182 C2 address. |
| IPV4 | 45[.]86[.]162[.]197 | Listed as a TAG-182 malicious infrastructure IP indicator. |
| IPV4 | 46[.]30[.]191[.]105 | Listed as IP infrastructure highly likely controlled by TAG-182. |
| IPV4 | 46[.]30[.]191[.]123 | Listed as a TAG-182 malicious infrastructure IP indicator. |
| IPV4 | 89[.]144[.]145[.]237 | Listed as a TAG-182 malicious infrastructure IP indicator. |
| IPV4 | 89[.]144[.]145[.]239 | Listed as a TAG-182 malicious infrastructure IP indicator. |
| SHA256 | 13440348516ccee839675f6ac908dd1724ce1d28f92af92fdc7938740d2b7ec5 | Hash identified in the YARA rule for tracking the TAG-182 MarkiRAT backdoor. |
| SHA256 | 3b172281f65ceaee280ae810edb6fd39a1ecd25649f929f246c0405df94f4c89 | Hash of the YEPlayer.dll sample linked to TAG-182 threat activity. |
| SHA256 | 400eb6a94810323a1fc5f8ab31c682fe765aaec2cc61b37c31d719c7e45c9a6c | Hash of the Pis2rayVPN.zip sample linked to TAG-182 threat activity. |
| SHA256 | 51a6686b8c5ec7c610637398f3de43589f4e9fcbe8bcc0245343c5454d3b91de | Hash of the YEMPlayer.msi sample linked to TAG-182 threat activity. |
| SHA256 | 66dcd98c6b310f4429890821e609d48cc6395a6be15ffe5a121ec68b7a8f7402 | Hash of the YEMPlayer.zip sample linked to TAG-182 threat activity. |
| SHA256 | 6c74d29903bc2cc17ec4afdb1a120d2060209b22830cee2b7005f5436e86f90e | Listed as a SHA256 indicator in Appendix A. |
| SHA256 | 8a7f5c8533df9e51b2da7cc2aeb52d8787418e4915577cc9288be1e46d1945c6 | Hash of the Pis2rayN.dll sample linked to TAG-182 threat activity. |
| SHA256 | a4f1b79e96a7d016de1991a64506792018de99eac5df00f7cabe26ef41b2bd81 | Hash of the Pis2rayVPN.msi sample linked to TAG-182 threat activity. |
| SHA256 | bb0c7ae4f12e5141480ee26f473636b07e836bb994ff3b2cfec93d4480da171b | Hash identified in the YARA rule for tracking the TAG-182 MarkiRAT backdoor. |
| SHA256 | cc59bf019af195dcec4394ffd7a8e23c080f4e02b12dcb7c04fb1da6671922a1 | Listed as a SHA256 indicator in Appendix A. |
| SHA256 | ea755862ee81dd0d991b4afca42d8b82bb22a8f1d370bf3d28dbf2e44ab241dd | Listed as a SHA256 indicator in Appendix A. |
| SHA256 | f7bde19f9e085650378076dabac586dcdc256e743a57890000e71a7ebb43d8ee | Hash identified in the YARA rule for tracking the TAG-182 MarkiRAT backdoor. |
| SHA256 | fa246327bed8fc5864827a8147b8b7aedb6246068259b8c97e82adb957315347 | Hash identified in the YARA rule for tracking the TAG-182 MarkiRAT backdoor. |
| URL | hxxps[:]//vip[.]yeplayer[.]store/files/YEPlayer.rar | Attacker-controlled staging URL that delivers the YEPlayer payload. |
MITRE ATT&CK
T1059.003 · Windows Command ShellThe SIGMA rule detects MarkiRAT-related bitsadmin commands in Windows command-line activity.T1197 · BITS JobsMarkiRAT uses bitsadmin commands and BITS jobs to retrieve files from remote URLs.T1204.002 · Malicious FileExecution follows extraction and running of the YEPlayer.exe malicious file.T1566.001 · Spearphishing AttachmentFake Android application lures and staged archives are used to deliver malware to targets.T1566.002 · Spearphishing LinkSocial media posts and links lure targets to staging websites for fake applications.T1583.001 · DomainsThe article identifies TAG-182 infrastructure domains as acquired/used infrastructure.
Threat Actors
Domestic KittenExplicitly identified in the article as another name for GreenEcho.Ferocious KittenPreviously associated with MarkiRAT; the article notes tradecraft overlap with TAG-182 but says further evidence is needed to establish an organizational link.GreenEchoNamed as a pro-Iranian cyber-surveillance group; the article also identifies it as Domestic Kitten.Rampant KittenNamed as a pro-Iranian cyber-surveillance group supporting digital monitoring campaigns.TAG-182Threat cluster associated with MarkiRAT dissemination and surveillance targeting Farsi-speaking users.
Malware
BouldSpygroup is tracked separately and uses unique tradecraft, specific malware (MarkiRAT, FurBall, DCHSpy, and BouldSpy), and infrastructure, and is almost uniquely dedicated to supporting the Iranian government andDCHSpyEach group is tracked separately and uses unique tradecraft, specific malware (MarkiRAT, FurBall, DCHSpy, and BouldSpy), and infrastructure, and is almost uniquely dedicated to supporting the Iranian government andFurBallEach group is tracked separately and uses unique tradecraft, specific malware (MarkiRAT, FurBall, DCHSpy, and BouldSpy), and infrastructure, and is almost uniquely dedicated to supporting the Iranian government andMarkiRATInsikt Group has identified new infrastructure associated with the TAG-182 threat cluster, used to disseminate MarkiRAT malware in support of Iranian government surveillance operations.
Products
Pis2ray VPNOther sample names also include “Pis2ray VPN”, which is not a legitimate application on either Google Play or Apple’s App Store (see Appendix A for additional IoCs).YESHICAThe IoCs, specifically the lures, suggest that threat actors custom-built a website that acts as a staging point for an application called “YESHICA” (Table 1).YESHICA YEPlayerIn March 2026, Insikt Group identified a new sample associated with TAG-182’s updated infrastructure that uses an almost identical media player theme name, “YESHICA YEPlayer” (Figure 1).