Recent reports reveal how the Iranian regime has been using malicious apps to spy on users’ smartphones. The report was issued in one of the most recent publications of the France-based National Council of Resistance of Iran (NCRI), widely held as the most influential Iranian opposition party.
In the report, NCRI exposes the attempts of government-backed hackers to develop apps designed to feed information on users’ devices back to central servers. This practice on the part of the regime was originally identified by researchers of the US branch of NCRI. The evidence was compiled into a paper entitled “Iran Cyber Repression: How the IRGC Uses Cyberwarfare to Preserve the Theocracy” and was released earlier this month. As a result, Google was able to identify at least one application on Google Play engineered by Iranian programmers. That app, called “Telegram Black,” has been removed from Google Play and the developer banned from offering additional apps on the site. Unfortunately, this incident is really just the tip of the iceberg.
Producing publicly available apps loaded with malware is and has been a broad-based strategy of the Iranian regime for quite some time. The regime has created close to 100 spyware apps, including Mobogram, Telegram Farsi, Hotgram, Wispi, and Telegram Talayi, all designed to resemble popular apps. These programs have already been unwittingly downloaded by hundreds of Iranian citizens.
The appearance of Telegram Black shows the risk these programs pose to international users as well. According to Alireza Jafarzadeh, the deputy director of the NCRI-US, the Iranian security apparatus contains “a unit called the Intelligence Organisation, a specific department allocated to cyber warfare. This is the department that deals with the cyber warfare against the Western countries [and] against its own population.”