Hackers Aid Protests Against Iranian Government with Proxies, Leaks and Hacks

Several hacktivist groups are using Telegram and other tools to
aid anti-government protests in Iran to bypass regime censorship
restrictions amid ongoing unrest^[1]
in the country following the death of Mahsa Amini in custody.

“Key activities are data leaking and selling, including
officials’ phone numbers and emails, and maps of sensitive
locations,” Israeli cybersecurity firm Check Point said^[2]
in a new report.

The company said it has also witnessed sharing of proxies and
open VPN servers to get around censorship and reports on the
internet status in the country, with one group helping the
anti-government demonstrators access social media sites.

Chief among them is a Telegram channel called Official Atlas
Intelligence Group (AIG) that’s primarily focused on publishing
data associated with government officials as well as maps of
prominent locations.

Calling itself the “CyberArmy,” the group is said to have
commenced its operations in May and has also advertised a wide
range of services in the past, such as data leaks, DDoS attacks,
and remote access to organizations. It’s also known to voluntarily
hunt and dox pedophiles.

According to Cyberint, the cyber mercenary actor also claims^[3]
to have “connections with people in several law enforcement
entities in Europe who can deliver sensitive information about
certain individuals exclusively.”

A second group of interest is ARVIN, which consists of about
5,000 members and shares news reports about the ongoing protests
along with providing a list of Open VPN servers to circumvent
internet blockades^[4].

RedBlue™, a 4,000-member group on Telegram, has also pitched in
with similar efforts, in addition to sharing hacking conversations
and guides.

Privacy-focused messaging app Signal, for its part, has reached out to its
community^[5] to set up a proxy that
will help people in the country use the service on Android.