Iran's Reformists Gear Up For Parliamentary Elections In 2024

The group calling itself Moneybird allegedly deployed the ransomware against Israeli organizations, CheckPoint's Incident Response Team investigated.

Researchers found that it resembled Agrius, a hacker group that has been around since 2020 and disguised itself with aliases like BlackShadow.

In late 2020, the group released ransomware on Shirbit, an Israeli insurance company. It also released wiper attacks on Bar-Ilan University in 2021.

Researchers at CheckPoint report that Moneybird is a new product for the group. Previous attacks were mostly carried out using ransomware known as Apostle.

Though the researchers didn't specify what types of organizations were targeted, they emphasized that the techniques used were Agrius-approved.

Threat actors gained entry via public-facing web servers and “unique variants of ASPXSPY” -- a malicious script hidden inside a “Certificate” text file.

It then moved laterally within networks, conducting reconnaissance and exfiltrating data. CheckPoint reports that the group uses "targeted paths," which allow the ransomware to disregard most files within targeted networks.

“Moneybird, like many other ransomwares, is a grim reminder of the importance of good network hygiene, as significant parts of the activity could have been prevented early on,” the researchers said.

According to Microsoft Threat Intelligence, the Iranian government is increasingly combining influence operations with cyberattacks.

Last year, they identified 24 "cyber-enabled operations" linked to the Iranian government, compared to seven the year before, and found a decline in the types of ransomware and wiper attacks Agrius usually employs.

Human rights sources reported that Mohammad Daraie, Mehdi Salari, Majid Jafari, Ali Tayyeb, Ali Piri, Qaderbakhsh Dehani, and Abdol-Rasool Jamshidi were executed in Jiroft, Isfahan, Kerman, and Urmia prisons in the early hours of Thursday.

The number of executions has exceeded 110 in the last month.

Meanwhile, the Center for Human Rights in Iran (CHRI) called on world leaders to increase pressure on the Iranian regime to end the flagrantly unlawful executions of protesters and others that are on the rise.

“The Islamic Republic is hanging young protesters—after torturing them into making 'confessions' and convicting them in sham trials—and targeting minorities for executions for lesser crimes, in order to cow its restive population into silence,” said the group in a letter delivered to 75 governments around the world on Wednesday.

“Unless world leaders join forces to raise the cost to the authorities in Iran of these state-sanctioned killings, which severely violate international laws governing the death penalty, the Islamic Republic’s killing machine will gather steam and more people will unjustly die on the gallows in Iran,” said Hadi Ghaemi, CHRI Executive Director.

Over 500 protesters, including 71 children, have been killed by state security forces since the death in custody of Mahsa Amini in September. Untold others have been maimed and blinded, 22,000 people have been arrested, and raped, and many have been tortured. A UN expert on Iran has described these atrocities as crimes against humanity.

Hossein Amir-Abdollahian, part of a government deemed one of the harshest dictatorships in the world, stated that the Taliban is only part of the reality in Afghanistan not all of it.

In spite of Iran's oppression of women which has led to months of uprisings since September, when Mahsa Amini was killed in morality police custody for the wrong wearing of her hijab, the minister said: “We are unhappy with the ban on Afghan women and girls to study because this is against the teachings of the Prophet of Islam."

Iran had good relations with the Taliban before the tensions over the Islamic Republic’s water share from the Hirmand river.

Due to Taliban damming to halt the flow of water from Afghanistan hundreds of thousands of civilians' lives have been badly affected in the southeastern province of Sistan and Baluchestan.

While Afghanistan says it needs dams to store water for agriculture or to produce electricity, which it imports from neighboring countries including Iran, many environmentalists are critical of large-scale water engineering projects.

“We have had negotiations with the Afghan authorities, and we believe that according to the 1351 treaty, the issue must be resolved through legal channels,” said Amir-Abdollahian.

Afghanistan’s embassy in Tehran was “formally” handed over to the Taliban after the fall of President Ashraf Ghani in 2021.

Iran was the third country after Pakistan and Russia that handed the Afghan embassy to the Taliban.

"A short while ago, IDF (Israel Defense Forces) soldiers identified and downed a drone crossing from Lebanese territory into Israeli territory towards the town of Zar'it," the military said.

It did not immediately identify who had sent the drone from Lebanon and released a photo of a UAV lying in a thicket of thorns. "The IDF will continue to prevent any attempt to violate Israeli sovereignty," the military said.

Iran-backed Hezbollah controls a wide strip of land along Israel's borders, with fighters, weapons and military installations covering southern Lebanon to Israel's northern border. Hezbollah is financed and armed by the Islamic Republic of Iran.

Last month, Israel said Lebanese armed group Hezbollah was behind a rare roadside bomb attack that wounded a motorist in northern Israel in March, and in the past has said it shot down the group's drones.

In April, rockets were fired from Lebanon into Israel during Palestinian Israeli clashes. Lebanon claimed that Palestinians on its territory had fired the rockets, and not the Hezbollah, creating a convenient ambiguity to relieve Israel of the pressure to retaliate against Hezbollah.

Iran has been encouraging all its proxy forces in the region to intensify attacks against Israel this year.

Iran-backed Hezbollah and Israel fought a month-long war in 2006 and have traded fire on several occasions since, but have avoided a large-scale confrontation.

A banner has been installed on the closed door of the center that reads, “After receiving the concerns of the community and for their safety, we are saddened to inform you that all upcoming programs, including prayers, have been suspended until further notice.” The message was later removed.

The center was closed on Wednesday following an investigation by the UK Charity Commission into how it was run, following weeks of efforts by the charity watchdog to take control. The Telegraph cited unnamed sources as saying that "the Iranian regime decided to pull the plug on the operation rather than lose control to an interim manager appointed by the Charity Commission.”

According to the Charity Commission, the building was closed down, but the center’s charity will be run by the interim manager -- a senior partner at an international law firm identified as Emma Moody – who has been appointed “due to the trustees’ failure to comply with their legal duties and responsibilities and their failure to protect the charity’s assets”.

The inquiry into the charity was opened in November last year after the watchdog issued an official warning over “serious governance concerns” as well as the content of its website and the events it organizes.

Founded in 1995 and opened officially in 1998, the Islamic Center of England Ltd (ICEL) is a religious and cultural institute run by Ali Khamenei’s representative in the UK, Seyyed Hashem Mousavi, and funded by the Islamic Republic. The center, which hosted a vigil for Qassem Soleimani, head of IRGC’s extraterritorial Quds force who was killed in a US drone strike in 2020, has been called the cultural arm of the regime.

Senior UK officials have been calling for the closure of the center for years, with MP Alicia Kearns, the chair of the foreign affairs select committee, describing it as the "London office" of the Iranian regime. Theresa Villiers, a member of the intelligence and security select committee, called the charity "the voice" of Khamenei in the UK.

As calls continue to shut down the center, Security Minister Tom Tugendhat last week described it as a "vile threat" against the country.Tugendhat told The Times that the government was “pulling together” to deal with “this vile threat that’s taken over a country and is now threatening ours.”

During a parliamentary debate last week, several UK lawmakers called for the Islamic Republic’s outpost to be closed.

Tugendhat stated that MPs are “absolutely right” to be worried about such “cultural centers” in Britain, adding: “Sadly, the Islamic Centre for England is not alone and the work of the IRGC is not limited to those Iranian proxy organizations.”

Previously, a group of Iranians had prepared an online petition for the closure of the Islamic Center of England, which was signed by tens of thousands of people.

In recent months while global rallies against the Islamic Republic are growing, Iranians have demonstrated many times in London demanding the closure of the center.