Iranian Spyware Steals People's Info Via VPN
Private cybersecurity company Bitdefender has revealed information about an Iranian spyware that steals people's sensitive information through a VPN software.
Private cybersecurity company Bitdefender has revealed information about an Iranian spyware that steals people's sensitive information through a VPN software.
The Romanian firm published reported on efforts by the Iranian regime to phish information about people who use virtual private networks – or VPNs -- to circumvent severe restrictions the government put on internet access.
Iran has been filtering Internet content for more than two decades but in the past four months amid antigovernment protests the government has regularly shut off access and blocked popular applications such as Instagram and WhatsApp.
While most of the people around the world take access to Internet for granted, users in Iran have to try out dozens of apps and VPNs before they find a way to bypass ISP restrictions. And, while some VPNs are fake or blocked, there are some others that are deliberately laced with malware, such as the 20Speed VPN. This spyware enters the victim's computer as the user installs the filter-breaking file.
Since 2020, when people have started to work remotely from home, a problem has come up for businesses to monitor the activities and productivity of their employees. The solution comes in the form of monitoring software. One of the companies that offers such services is SecondEye with numerous capabilities that are not limited to screen recording, logging keystrokes, and live screen viewing. The monitoring application was developed in Iran and distributed legitimately via the developer’s website.
Earlier in the year, Blackpoint Cyber, specialized in stopping cyberthreats, identified and responded to two identical suspicious File Transfer Protocol (FTP) events connected to a server in Iran within a two-month span. This server was determined to belong to SecondEye.
Researchers at Bitdefender, as well as at Blackpoint, discovered a malware campaign that uses components of SecondEye suite and their infrastructure -- a legitimate monitoring application -- to spy on users of Iranian-based VPN service 20Speed but through Trojan-like installers of the VPN software that installed the spyware components along with the VPN product. The software, as well as another of the products EyeSpy, has the ability to fully compromise online privacy via keylogging and stealing of sensitive information, such as documents, images, crypto-wallets, and passwords.
The campaign started in May 2022, but detections peaked in August and September, as Iranians were rushing to use VPNs to get past the government’s restrictions. Most of the new detections originate from Iran, with a small pool of victims in Germany and the US.
The website of 20Speed is one of the most popular websites from which Iranians purchase their VPN subscriptions. The website has been active among Iranian users for about seven years. But if its VPN is laced with malware and collects personal information, the company cannot safeguard it from Iran’s intelligence services that can simply demand and receive access.
According to the data by the US company Similarweb -- which reviews and analyzes the statistics of the world's websites and provides behind-the-scenes analytics for every site online -- the main website of 20Speed had about one million visits during the three months ending in December 2022, most of them from Iran. Moreover, the Android version of this VPN, which is also available in the Google Play Store, has more than 100,000 active installations.
Earlier in January, the Islamic Republic decided to act against those selling VPNs and circumvention software to people, as a measure to further restrict access to the Internet. The Judiciary department in collaboration with the ministry of communications will take legal action against "unauthorized sellers of the VPNs and circumvention tools," local media reported. This is a measure to clamp down in real VPNs versus software that the government can have control over.
Almost all companies that sell VPN services inside Iran are affiliated with the government or state organizations. Most of these companies have increased their fees drastically during the past three months that Iranians have rushed to buy them to access the Internet. Many Iranians are unable to pay the higher prices for VPNs as the cost of food and other necessities have skyrocketed.
In the long run, if this trend continues, it is possible that people from the lower income will gradually lose their access to the global Internet, similar to what has taken place in China and these days in Russia. The security of such services is another problem as the Islamic Republic can easily acquire any data accessed by the users via VPNs.
Amid heightened restrictions on Internet access, Iranians’ use of VPNs rose over 3,000 percent in September, when Mahsa Amini was killed.
"Daily demand for VPN services in Iran is up over 3,000% compared to before the protests," Simon Migliano, the head of research at Top10VPN, told Axios, adding that "This is a massive spike, given that demand was already healthy before the social media shutdown."
Thousands of Iranians from all over Europe who have pledged to participate in the Monday rally are passionately discussing ways to get to Strasbourg on social media to send a strong message to the European Parliament that has a plenary session on Tuesday.
Some social media users have urged Syrians, whose country has been a playground for the IRGC, and Ukrainians whose Russian enemy uses the Iranian-made drones against them, to join the rally and support their cause.
An underground alliance of protester groups in Iran has also welcomed and supported the diaspora’s initiative. “We wish to declare our full support for listing [the IRGC] as a terrorist organization by the international community,” United Youth of Iran, an underground alliance of revolutionary youth groups from various Iranian cities, said in a statement sent to Iran International Saturday.
The group has criticized the IRGC’s suppression of protests in Iran, direct and indirect violation of human rights in other countries including Syria and Ukraine, and economic corruption including alleged involvement in drug and arms trafficking and money-laundering by the Guards. “The IRGC’s actions bring nothing but pain, death and corruption to the Middle East and the world,” the statement said.
Unlike the United States which in 2019 under President Donald Trump put the IRGC on its Foreign Terrorist Organizations (FTO) list, European countries avoided the designation in the past few years and prioritized diplomacy with the Islamic Republic in the hope of concluding a nuclear deal.
Talks in Vienna to revive the deal, officially known as the Joint Comprehensive Plan of Action (JCPOA) came to an abrupt stop in March 2022, reportedly for Iran’s insistence that the IRGC be removed from the US FTO list. Later talks elsewhere failed to bring about an agreement.
The US and European powers have shown much less interest in a deal following the Iranian government’s heavy-hand suppression of protests in the country in the past few months. As early as October, the US State Department spokesperson Ned Price said the deal was no longer the US government’s focus, and that focusing on supporting the protesters in Iran had taken priority.
News that Iran is supplying Russia with kamikaze drones also angered the West and added to the pressure to get tough with Tehran.
So far over 500 protesters have been killed by security forces, mainly consisting of the IRGC and its Basij militia. Four protesters have been executed so far by the state after hasty trials devoid of any regard for due process. Others are on death row.
Many politicians in France, Germany, and other European countries have been keen to pursue the IRGC’s designation by the EU and say that it has been long overdue.
“Let’s rally together, united, and with a common mind to label IRGC as a terrorist organization. Sanctioning criminals is not enough! We need a resolution! Let's make the world a safer place to live in!” Alireza Akhondi, Swedish-Iranian member of the Swedish parliament who has been campaigning for the EU designation of the IRGC tweeted on January 10.
In an interview with Iran International a week earlier, Akhondi said designation of the IRGC as a terrorist organization should be followed by tracing the organization’s money and blocking its money-laundering channels to weaken it.
Members of the UK House of Commons on Thursday unanimously voted for a motion urging the UK government to proscribe the IRGC by listing it as a terrorist organization.