People Express Support For Summoned Sunni Leader In Northern Iran

The Romanian firm published reported on efforts by the Iranian regime to phish information about people who use virtual private networks – or VPNs -- to circumvent severe restrictions the government put on internet access.

Iran has been filtering Internet content for more than two decades but in the past four months amid antigovernment protests the government has regularly shut off access and blocked popular applications such as Instagram and WhatsApp. 

While most of the people around the world take access to Internet for granted, users in Iran have to try out dozens of apps and VPNs before they find a way to bypass ISP restrictions. And, while some VPNs are fake or blocked, there are some others that are deliberately laced with malware, such as the 20Speed VPN. This spyware enters the victim's computer as the user installs the filter-breaking file. 

Since 2020, when people have started to work remotely from home, a problem has come up for businesses to monitor the activities and productivity of their employees. The solution comes in the form of monitoring software. One of the companies that offers such services is SecondEye with numerous capabilities that are not limited to screen recording, logging keystrokes, and live screen viewing. The monitoring application was developed in Iran and distributed legitimately via the developer’s website.

Earlier in the year, Blackpoint Cyber, specialized in stopping cyberthreats, identified and responded to two identical suspicious File Transfer Protocol (FTP) events connected to a server in Iran within a two-month span. This server was determined to belong to SecondEye.

Researchers at Bitdefender, as well as at Blackpoint, discovered a malware campaign that uses components of SecondEye suite and their infrastructure -- a legitimate monitoring application -- to spy on users of Iranian-based VPN service 20Speed but through Trojan-like installers of the VPN software that installed the spyware components along with the VPN product. The software, as well as another of the products EyeSpy, has the ability to fully compromise online privacy via keylogging and stealing of sensitive information, such as documents, images, crypto-wallets, and passwords.

The campaign started in May 2022, but detections peaked in August and September, as Iranians were rushing to use VPNs to get past the government’s restrictions. Most of the new detections originate from Iran, with a small pool of victims in Germany and the US.

The website of 20Speed is one of the most popular websites from which Iranians purchase their VPN subscriptions. The website has been active among Iranian users for about seven years. But if its VPN is laced with malware and collects personal information, the company cannot safeguard it from Iran’s intelligence services that can simply demand and receive access.

According to the data by the US company Similarweb -- which reviews and analyzes the statistics of the world's websites and provides behind-the-scenes analytics for every site online -- the main website of 20Speed had about one million visits during the three months ending in December 2022, most of them from Iran. Moreover, the Android version of this VPN, which is also available in the Google Play Store, has more than 100,000 active installations.

Earlier in January, the Islamic Republic decided to act against those selling VPNs and circumvention software to people, as a measure to further restrict access to the Internet. The Judiciary department in collaboration with the ministry of communications will take legal action against "unauthorized sellers of the VPNs and circumvention tools," local media reported. This is a measure to clamp down in real VPNs versus software that the government can have control over.

Almost all companies that sell VPN services inside Iran are affiliated with the government or state organizations. Most of these companies have increased their fees drastically during the past three months that Iranians have rushed to buy them to access the Internet. Many Iranians are unable to pay the higher prices for VPNs as the cost of food and other necessities have skyrocketed.

In the long run, if this trend continues, it is possible that people from the lower income will gradually lose their access to the global Internet, similar to what has taken place in China and these days in Russia. The security of such services is another problem as the Islamic Republic can easily acquire any data accessed by the users via VPNs.

Amid heightened restrictions on Internet access, Iranians’ use of VPNs rose over 3,000 percent in September, when Mahsa Amini was killed.

"Daily demand for VPN services in Iran is up over 3,000% compared to before the protests," Simon Migliano, the head of research at Top10VPN, told Axios, adding that "This is a massive spike, given that demand was already healthy before the social media shutdown."

Hashem Moazenzadeh, surgeon and activist, was arrested by the IRGC intelligence during nationwide protests late October.

According to Human Rights Activists News Agency (HRANA), the sentence was issued at a preliminary court and if it is approved at the appeals court, Moazenzadeh could serve up to three years.

Based on HRANA’s report, a revolutionary court in Tehran tried Moazenzadeh for charges such as "holding gatherings and conspiring against the security of the country" and "propaganda against the establishment."

Also, "a two-year ban on leaving the country, membership in parties, political and social groups, and activities in cyberspace" has been considered as an additional punishment for him.

During the protests by doctors in Tehran on October 25, another general surgeon was shot in the head and killed by the security forces.

Doctor Parisa Bahmani, from Zanjan, was killed during the gathering of doctors in front of Tehran Medical Council, after government forces opened fire on demonstrators.

Doctors had held the protest rally against the government’s policies of preventing medical care for the wounded protesters, using ambulances to transport security forces, and militarizing the hospitals.

The regime has killed over 500 people including tens of children during the protests since mid-September.

Thousands of Iranians from all over Europe who have pledged to participate in the Monday rally are passionately discussing ways to get to Strasbourg on social media to send a strong message to the European Parliament that has a plenary session on Tuesday.

Some social media users have urged Syrians, whose country has been a playground for the IRGC, and Ukrainians whose Russian enemy uses the Iranian-made drones against them, to join the rally and support their cause.

An underground alliance of protester groups in Iran has also welcomed and supported the diaspora’s initiative. “We wish to declare our full support for listing [the IRGC] as a terrorist organization by the international community,” United Youth of Iran, an underground alliance of revolutionary youth groups from various Iranian cities, said in a statement sent to Iran International Saturday.

The group has criticized the IRGC’s suppression of protests in Iran, direct and indirect violation of human rights in other countries including Syria and Ukraine, and economic corruption including alleged involvement in drug and arms trafficking and money-laundering by the Guards. “The IRGC’s actions bring nothing but pain, death and corruption to the Middle East and the world,” the statement said.

Unlike the United States which in 2019 under President Donald Trump put the IRGC on its Foreign Terrorist Organizations (FTO) list, European countries avoided the designation in the past few years and prioritized diplomacy with the Islamic Republic in the hope of concluding a nuclear deal.

Talks in Vienna to revive the deal, officially known as the Joint Comprehensive Plan of Action (JCPOA) came to an abrupt stop in March 2022, reportedly for Iran’s insistence that the IRGC be removed from the US FTO list. Later talks elsewhere failed to bring about an agreement.

The US and European powers have shown much less interest in a deal following the Iranian government’s heavy-hand suppression of protests in the country in the past few months. As early as October, the US State Department spokesperson Ned Price said the deal was no longer the US government’s focus, and that focusing on supporting the protesters in Iran had taken priority.

News that Iran is supplying Russia with kamikaze drones also angered the West and added to the pressure to get tough with Tehran.

So far over 500 protesters have been killed by security forces, mainly consisting of the IRGC and its Basij militia. Four protesters have been executed so far by the state after hasty trials devoid of any regard for due process. Others are on death row.

Many politicians in France, Germany, and other European countries have been keen to pursue the IRGC’s designation by the EU and say that it has been long overdue.

“Let’s rally together, united, and with a common mind to label IRGC as a terrorist organization. Sanctioning criminals is not enough! We need a resolution! Let's make the world a safer place to live in!” Alireza Akhondi, Swedish-Iranian member of the Swedish parliament who has been campaigning for the EU designation of the IRGC tweeted on January 10.

In an interview with Iran International a week earlier, Akhondi said designation of the IRGC as a terrorist organization should be followed by tracing the organization’s money and blocking its money-laundering channels to weaken it.

Members of the UK House of Commons on Thursday unanimously voted for a motion urging the UK government to proscribe the IRGC by listing it as a terrorist organization.

Iran Daily, the formal government newspaper, leveled the accusation on Saturday, saying that the Friday Imam of Zahedan in the largely Sunni southeastern Sistan- Baluchestan province continues to play his “destructive role against national security and unity”.

The daily also claimed in an editorial note that the “CIA media arms have invested on Abdolhamid”.

After the Bloody Friday of Zahedan on September 30, in which tens of Baluch citizens were killed by the regime, Mowlavi Abdolhamid held Supreme Leader Ali Khamenei responsible and demanded the cancellation of death sentences for protesters. He has continued calling for justice and respect for the people, gaining support from non-Sunni Iranians.

Last week, Mohammad Javad Larijani, one of the political figures of the Islamic Republic, implicitly called for the destruction of Makki Mosque in which Mowlavi Abdolhamid makes critical sermons on Fridays.

Earlier in November, the hacktivist group Black Reward targeted the data servers of Fars news agency, a media network affiliated with the Islamic Republic's Revolutionary Guard, releasing several documents to media indicating that Khamenei is dismayed by Mowlavi Abdolhamid’s remarks, the most prominent religious leader of Iran's largely Sunni Baluch population.

The documents also revealed that instead of arresting or harming him, Khamenei ordered underlings to tarnish Abdolhamid’s reputation so that his influence would decrease among the Sunni population of the country.

Mohammad-Mehdi Hosseini Hamedani, the Friday prayer imam of the city, reiterated that observance of hijab should be enforced strictly in society. 

Describing anyone who unveils in public as an enemy, he emphasized that all such people must be confronted by the state. "It is not possible to imagine that we are living in an Islamic country when we enter some institutions, shopping malls, pharmacies, etc.!" he said, calling on the authorities to warn shops and malls that serve women who have removed their hijab and close them down if warnings did not suffice. 

This is not the first time that the Islamic Republic’s hardliners are linking Islamic rituals to drought or natural disasters. 

Ahmad Alamolhoda, a senior firebrand cleric who is the father-in-law of President Ebrahim Raisi, had earlier called on people to say prayers for rain to solve the problem of drought in the country. 

Prosecutor General Mohammad Jafar Montazeri in 2019 said, "The judicial system does not allow women to unveil in public, because it causes natural disasters such as floods and earthquakes in the country.”

Yousef Tabatabai Nejad, Ali Khamenei’s representative in the central city of Esfahan (Isfahan), said in 2016 that women who unveiled and took photos “like Europeans” are the reason for the city’s river, Zayandeh-Roud (Zayanderud) to go dry and added that if this continues, its headwaters will also dry up. 

The water crisis has been getting worse in Iran for the past decade because of mismanagement in constructing unnecessary dams, encouraging water-thirsty crops like rice and political influence in water distribution.