Nariman Gharib
banner
nariman.bsky.social
Nariman Gharib
@nariman.bsky.social
Britain-based Iranian Activist 🚦 Cyber Espionage Investigator 👁
KittenBusters leaked #APT35 infrastructure docs. Using leaked passwords, I accessed their Edis Global accounts & downloaded invoices. They used phone numbers from Russia, Israel & Netherlands with fake addresses, paying via crypto. files.narimangharib.com/other/CK%20-...
October 29, 2025 at 2:18 PM
😀
October 28, 2025 at 10:05 AM
October 23, 2025 at 12:45 PM
October 18, 2025 at 5:01 AM
October 1, 2025 at 10:55 AM
🤣🤣🤣🤣🤣🤣
September 3, 2025 at 5:57 PM
Iran's defense sector offers $213,000 prize for counter-drone technology, seeking systems to detect and neutralize small UAVs through jamming, AI tracking, or physical interception. Competition highlights Tehran's push for indigenous anti-drone capabilities hxxps://archive[.]is/qCyIt
August 14, 2025 at 8:20 AM
Tonight, Iran International TV exposed the identity of a Handala hacking group admin—part of the Banished Kitten cyber unit I've previously reported on—and unmasked his handler in Iran's Ministry of Intelligence.

- Morteza Aftabi-Far
- Ali Bermoudeh
August 13, 2025 at 8:15 PM
August 9, 2025 at 12:26 PM
Remember his name: Hesam Roshani. #APT39
July 24, 2025 at 4:11 PM
July 16, 2025 at 9:04 AM
No caption needed.
April 10, 2025 at 7:32 AM
The Cyber Police of Iran, seeing an opportunity to push further, are now targeting activists' YouTube accounts by accessing their Gmail credentials, after Instagram and Meta did not take action to prevent their recent attempts to seize and delete Instagram accounts of singers and online activists.
March 12, 2025 at 11:25 AM
Iran International TV revealed the identities of nine operatives from Parsian Rayan Borna (پارسیان افزار رایان برنا), a front company tied to the Ministry of Intelligence of the Islamic Republic. They conduct cyberattacks, like one on Albania, and manipulate public opinion via fake social accounts.
January 12, 2025 at 10:57 AM
Previously, information about Iran's cyber and cyber-electronics units was available only as images. To make it more accessible for security researchers and journalists, I've organized it into an easy-to-navigate chart on the website.

cyberunits.iranianthreatactors.com
October 29, 2024 at 11:22 AM
Message delivered.
March 1, 2024 at 3:30 PM
The cyber group #Bakhtak,which previously hacked Astan Quds Razavi and the Martyrs Foundation, announced a few minutes ago that they have hacked the Foundation of the Oppressed of the Islamic Revolution and are currently uploading files from the foundation on their website and Telegram. #CyberAttack
February 27, 2024 at 11:15 PM