Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool

## Executive Summary

Recorded Future’s Insikt Group reports that **TAG-182**, an Iran-nexus threat cluster, is distributing **MarkiRAT** malware through fake VPN and media-player applications to support surveillance operations against Farsi-speaking targets. The activity is assessed as highly likely focused on Iranians inside and outside Iran, including individuals associated with anti-government movements or perceived dissident communities.

The campaign uses deceptive application lures such as **YEPlayer**, **YEMPlayer**, and **Pis2ray VPN**, with infrastructure designed to impersonate legitimate services and brands, including Microsoft, Google, Facebook, Instagram, VPN services, and media tools. The malware delivery chain includes staged archive downloads, user execution of malicious files, and follow-on communication with attacker-controlled infrastructure.

A key technical finding is the overlap between TAG-182’s MarkiRAT activity and historical **Ferocious Kitten** tradecraft. The report highlights shared use of **BITSAdmin job strings**, similar file-naming conventions, and related command-and-control patterns. These overlaps support a credible operational relationship, though the report states that additional evidence is needed to confirm whether TAG-182 and Ferocious Kitten are organizationally linked.

From a defensive standpoint, the most actionable behaviors include suspicious **BITSAdmin** usage, requests to MarkiRAT-specific URI paths such as `/i.php?u=` and `/uploadx.php?u=`, execution of suspicious fake application files, and masquerading through `svehost.exe`, which appears designed to impersonate the legitimate Windows `svchost.exe` process.

The report assesses that Iranian cyber-surveillance activity is likely to increase following the partial restoration of internet access in Iran on **May 26, 2026**, as state security organizations seek to monitor perceived dissidents and enforce domestic security objectives. TAG-182’s activity should therefore be treated as part of a broader Iranian digital surveillance ecosystem rather than an isolated malware campaign.

For SOC and detection engineering teams, the recommended priority is to ingest the provided indicators, hunt across endpoint and network telemetry for MarkiRAT behaviors, and build resilient detections around **BITSAdmin abuse**, suspicious file execution from user-writable paths, fake VPN/media-player download activity, and C2 upload patterns. Exact IOC matches should be validated through endpoint process lineage, network activity, file metadata, and user context before making incident conclusions.