THREATOPS
THREAT OPSThreat News › Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool

Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool

lowrecordedfuturePublished 2026-07-01

<h2>Executive Summary</h2> <p>Insikt Group has identified new infrastructure associated with the TAG-182 threat cluster, used to disseminate MarkiRAT malware in support of Iranian government surveillance operations. It is highly likely that TAG-182 is targeting Iranians living inside and outside the country using different lures, including free download tools and fake VPN applications. The

Attributed threat actors

MITRE ATT&CK techniques

Original source: https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat