⚡️🇮🇷 Recorded Future: An Iran-linked APT cluster tracked as TAG-182 is running a surveillance campaign with the MarkiRAT malware, targeting users in Iran and overseas via trojanized VPN and media apps.

Analysts say the operation fits into Tehran’s broader state-backed cyber crackdown, using fake Android apps and social media lures to monitor suspected dissidents and alleged foreign collaborators.